Every firm putting AI into production is having an argument about models, vendors, and confidentiality terms. Those are real questions and they are not the important one.
The important one is a line-drawing question, and a firm answers it whether or not it notices: what is an agent allowed to do without a human pressing the button?
My answer, stated as a rule and applied everywhere in this firm’s stack: agents produce drafts and staged actions. A human fires anything that crosses the firm’s boundary. Every email. Every filing. Every posted time entry. Every dollar.
I want to be precise about the claim, because it is usually heard as timidity. It is not a phase. It is not caution I expect to relax as the models improve, and the models have improved enormously since I adopted it. Drafts-only is a permanent architectural choice, for the same reason a bank keeps dual control over a wire transfer after thirty years of the teller never stealing anything. The design is not a statement about the competence of the actor. It is a statement about the asymmetry between the cost of a checkpoint and the cost of an unrecoverable action.
And it has a second property, which is the one that ought to interest lawyers most: it is the only architecture I know of in which the profession’s supervision duties are discharged at a designed place rather than on faith.
The rules already drew this line
Before AI, before software, the Rules of Civil Procedure already located the moment where responsibility attaches — and they did not locate it at drafting.
Minn. R. Civ. P. 11.02 provides:
By presenting to the court (whether by signing, filing, submitting, or later advocating) a pleading, written motion, or other document, an attorney or self-represented litigant is certifying that to the best of the person’s knowledge, information, and belief, formed after an inquiry reasonable under the circumstances: (a) it is not being presented for any improper purpose …; (b) the claims, defenses, and other legal contentions therein are warranted by existing law or by a nonfrivolous argument for the extension, modification, or reversal of existing law or the establishment of new law …
Read what that rule regulates. Not composition. Presentment. You may write anything; a rough draft asserting a theory you have not researched violates nothing. The certification attaches at the instant the document crosses the boundary between your office and the tribunal, and it attaches to a person.
That is a drafts-only architecture. It has been one since long before anyone had a model to worry about. The paralegal who assembles the motion, the associate who writes the first three sections, the form book, the brief bank — none of them certify anything. The signer does, and what the signer certifies is an inquiry reasonable under the circumstances.
So when I say the agent drafts and the human sends, I am not proposing a novel safety framework for a novel technology. I am declining to break a structure the profession has always had. The interesting engineering question is not whether to keep the checkpoint. It is how to keep the checkpoint real as the volume of work flowing through it goes up by an order of magnitude.
Which is exactly where firms are failing right now.
A checkpoint with nothing behind it
In Garner v. Kadince, 2025 UT App 80, the Utah Court of Appeals sanctioned counsel over a petition for interlocutory appeal containing fabricated authority. The mechanics are worth reading closely, because they are not what the headline version suggests.
The petition had been prepared by an unlicensed law clerk at the firm who used ChatGPT. One of the two attorneys was not involved in drafting at all. As to the other, the court recorded that “Mr. Bednar did not independently check the accuracy of the Petition before signing and filing it with the court.” The firm, counsel acknowledged, “did not have any policy in place addressing the use of AI,” formally or informally, and had begun writing one only after the order to show cause issued.
Note what was not missing. A human checkpoint existed. A licensed attorney signed. The signature was there and the human was there, and the result was fake precedent in an appellate filing, opposing counsel’s fees, a refund of the client’s fees, and a $1,000 sanction.
The court’s framing of the duty is the durable part:
[W]e emphasize that every attorney has an ongoing duty to review and ensure the accuracy of their court filings.
And, quoting Mata v. Avianca, Inc., 678 F. Supp. 3d 443, 448 (S.D.N.Y. 2023):
[T]here is nothing inherently improper about using a reliable [AI] tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.
Garner is not an argument against AI drafting. It is an argument that a checkpoint is a place where work happens or it is theater. The Colorado Court of Appeals reached a comparable posture in Al-Hamim v. Star Hearthstone, LLC, 2024 COA 128, 564 P.3d 1117 — declining to sanction a self-represented litigant whose brief contained hallucinated citations, while putting “him, the bar, and self-represented litigants on notice” that future filings might not be treated so gently.
So the design problem is sharper than “keep a human in the loop.” A human was in the loop in Garner. The design problem is: how do you build a checkpoint that a busy person will actually perform rather than clear?
Four rules, in the order they matter.
One: the boundary is defined by consequence, not by tool
The instinct is to classify by technology — the AI can use this system but not that one. That is the wrong axis, and it produces incoherent policies where an agent may not touch email but may rewrite a document that becomes an exhibit.
Classify by consequence. Two questions, asked of the action rather than the tool:
Is it externally visible? Does it reach a client, an opposing party, a court, a bank, a credit reporting agency, a vendor — anyone outside the firm? If yes, a human fires it, because outside the firm is where reputation, admissions, and waivers live.
Is it reversible cheaply? Not “is it reversible in principle” — every database row can be edited. Can you undo it before it matters, at trivial cost, with no one having relied on it? A misfiled document in a matter folder is reversible. A sent email is not: recall is a fiction, and the recipient’s copy is the record.
Everything that is internal and cheaply reversible, an agent may simply do. In this firm that is a large territory and it is where nearly all of the productivity actually comes from: reading and labeling mail, extracting dates from a scanned order, pulling statutes as raw HTML, summarizing a record, generating a report, drafting from the firm’s templates, searching case law, writing the first draft of anything.
Everything external or irreversible is staged. The agent builds the action completely and stops.
The unglamorous corollary is that money is always on the human side of the line, without exception and without regard to amount, because money is the category where reversal is most expensive and the professional consequences are strictest. Trust accounting is not a place for a probabilistic system to have write authority — a point I have made at more length about where deterministic code is mandatory.
Two: approval must be batched, or you are training a reflex
This is the rule that firms get wrong even when they get rule one right, and there is good evidence about why.
Medicine ran this experiment for us, at scale, with clinical decision support. Ancker and colleagues studied 112 clinicians and roughly 1.6 million alerts across a network of community health centers and found:
Likelihood of reminder acceptance dropped by 30% for each additional reminder received per encounter, and by 10% for each five percentage point increase in proportion of repeated reminders.
Thirty percent per additional alert. The confirmation dialog is not a safety feature with linear returns; past some volume it is an anti-safety feature, because it manufactures the habit of clicking through. A system that asks a lawyer forty times a day whether it may proceed has not created forty checkpoints. It has created one reflex.
So the engineering requirement is not “ask before acting.” It is ask once, about everything, in a form a human can actually read. When this firm’s billing agent finds a day’s worth of uncaptured work, it does not surface forty prompts. It surfaces one table — matter, date, duration, narrative, rate — and asks for a single approval over the batch, with the option to strike lines. One artifact, one decision, one place where a person’s attention is actually spent.
The same shape governs the rest of it. Outbound correspondence for the day is reviewed as a set of drafts sitting in the mail client. Publication is one push. Intake is a conflict check plus a read-back of the captured facts before anything is created anywhere.
Batching feels less safe. It is more safe, because the alternative is a person who has stopped reading.
Three: the agent prepares the action fully, so approval is cheap
The cost of approving is the variable that decides whether approval is real. If saying yes requires the human to finish the work, the human will start saying yes without looking, or will stop using the system.
So a staged action must be complete. Not a proposal — the actual artifact, built.
For email that means the draft exists in the mail system, addressed to the real recipient, with the subject and body final. This is a genuine architectural property and not a convention: the Gmail API’s users.drafts.create method “[c]reates a draft with the DRAFT label,” and a separate users.drafts.send call is required to transmit it. The agent holds a credential that can compose. Sending is a different call, and a person makes it, from their own mail client, having read the thing. There is no configuration in which enthusiasm turns a draft into a sent message.
For time entries it means the narrative is written, the matter is attributed, and the rounding rules the practice management system will apply have already been applied, so the number on the screen is the number that will post. For a filing it means a document that is formatted to the court’s requirements and opens correctly, with the caption and signature block populated, so the lawyer’s remaining job is the only job that requires a lawyer: reading it and deciding whether to certify it.
Put the other way — the agent’s job is to make the human’s decision as close to pure judgment as possible. Every mechanical step left at the checkpoint is a step that competes for the attention the checkpoint exists to capture.
Four: the checkpoint has to be auditable, and the gates have to be able to fail
A checkpoint you cannot reconstruct afterward is not a control. It is a memory.
Log the staged action, the human decision, the identity, and the time — append-only, because the point is to answer questions later that you did not know you would have. If a client asks why a letter went out on the 14th, the answer should be a record, not a recollection.
And the gates that run before the checkpoint have to be capable of reporting failure. This firm’s pre-publish link checker carries a comment in its own source explaining why it exists in its current form: it was rewritten after a set of shell loops “silently did nothing under zsh (which does not word-split unquoted parameter expansions), so link checks reported ‘safe’ without ever running.” The script’s docstring now records that “[e]xit status is meaningful: 0 clean, 1 problems found.”
That is the failure mode that should frighten you more than a bad draft. A bad draft is visible. A verification step that returns success without having executed is invisible, and it degrades a real control into a ritual while every dashboard stays green. If your gate has never blocked anything, you do not have evidence that your work is clean. You have an untested gate. I have written separately about checks that cannot fail and failures that say nothing, because between them they account for most of the quiet damage in automated systems.
What it looks like when it runs
Two days ago this firm published thirty long-form articles on Minnesota law. The pipeline is the thesis of this essay in operating form.
Five drafting agents worked in parallel from written assignments, each pulling statutes as raw HTML from the Revisor and reading cases in full rather than from search snippets. None of them could publish. Their output went to independent verification agents that did not write the articles, working a four-pass protocol — inventory, existence and accuracy, adversarial re-check, reconciliation — against primary sources, with the drafter’s own citation manifest treated as a claim to be tested rather than proof.
The gate reports show what that buys. A pin cite corrected from page 634 to 635. A block quote that had silently dropped a trailing clause, restored with an ellipsis added “so the inline quote is no longer presented as a closed sentence it is not.” A year in a case citation that an intermediate source rendered as 1964, resolved to 1954 only by pulling the original opinion directly rather than trusting the quoting court’s copy.
None of those errors would have been caught by a lawyer reading for sense. All of them were caught because a second, non-authoring reader was required to re-derive every citation from the source, and because the author of a claim was never permitted to be its verifier.
Then the build ran, the link check ran with a meaningful exit status, and a human pushed. Thirty articles, one trigger, one person accountable.
The professional-responsibility part, stated carefully
I am not going to tell you that Minn. R. Prof. Conduct 5.3 governs software agents. Whether a rule written for “a nonlawyer employed or retained by or associated with a lawyer” reaches a model is a genuinely contested question, and a Practice Lab essay is not where it gets settled.
What is not contested is the standard the supervision rules apply, and it is a standard about systems rather than diligence. Rule 5.1(a) requires a lawyer with managerial authority to “make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that all lawyers in the firm conform to the Rules of Professional Conduct.” Rule 5.3(a) uses nearly identical language for nonlawyers. The operative noun in both is measures. Not care, not attention, not good intentions — measures, in effect, at the firm.
That framing is unusually friendly to the argument I am making here. A firm cannot demonstrate that it was careful. It can demonstrate that every outbound communication was composed as an unsent draft and transmitted by a named person; that no automated process holds credentials to move money; that citation verification is performed by an agent that did not draft; that approvals are logged. Those are measures. They are describable, testable, and producible.
The comparison case is Garner, where counsel had to tell an appellate court that the firm had no policy at all. The relevant deficiency there was not a bad model. It was the absence of anything to point at.
Two adjacent rules also deserve mention, because they identify triggers that do not belong to the lawyer either. Rule 1.2(a) provides that “[a] lawyer shall abide by a client’s decision whether to settle a matter,” and Rule 1.4(b) requires a lawyer to “explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation.” Some buttons are the client’s. Any system design that quietly relocates one of those decisions into the firm’s workflow is wrong before you get to the technology.
What would prove me wrong
The honest failure mode of drafts-only is that it makes the human the bottleneck. If an agent can stage more work than a lawyer can genuinely review, the architecture degrades into rubber-stamping with extra steps — and rubber-stamping with an audit log is worse than no automation, because it manufactures documentation of a review that did not occur.
I think that risk is managed by rules two and three rather than by abandoning the model, but it is the real risk, and it is the thing I watch. The tell is easy to spot: approval time per batch falling while batch size rises.
Here is the falsifiable version. I predict that within five years the malpractice claims and sanctions orders in this area will cluster overwhelmingly on firms that let agents act externally without a human trigger, and not on firms that were slow because a person had to read things. If instead the losses cluster on firms whose lawyers approved batches they could not meaningfully review, then batching is the flaw and the answer is smaller batches with harder gates, not fewer prompts. And if five years from now the firms with the best client outcomes and the cleanest discipline records are the ones that let agents send email and move money unattended, then I was simply wrong about the asymmetry, and the reason will be that reversal got cheap in a way I did not anticipate.
What would not move me: better benchmark scores. The rule was never premised on the model being unreliable.
The reason this matters beyond risk management
There is a version of this essay that is entirely defensive — controls, exposure, sanctions. That version is true and it is not the point.
The point is that if you get the boundary right, you can be genuinely aggressive everywhere inside it. A firm that has decided, precisely, that nothing leaves without a person can let agents do enormous amounts of real work without anyone lying awake about it. The caution is concentrated at one designed place, which is exactly what lets the rest of the system move fast. Firms that have not drawn the line clearly end up cautious everywhere and slow everywhere, and get a fraction of the benefit for the same anxiety.
And the checkpoint is not overhead. It is the thing being sold. A client is not buying documents; a client is buying a person who is accountable for them — the judgment about consequence, the license behind it, and the fact that when something goes wrong there is someone to answer for it. Drafting was never the scarce part of this profession, and it is about to be very much less scarce.
Which is the optimistic reading, and the reason any of this is published free. If the drafting cost collapses and the accountability stays exactly where it has always been, competent representation gets cheaper without getting worse — and that gap between the number of people with legal problems and the number who can afford to do anything about them gets a little smaller. But only if the profession keeps the human on the send button, and only if pressing it still means something.
Sources
- Minn. R. Civ. P. 11.01, 11.02 — signature requirement; certification arising from presenting a document to the court, “formed after an inquiry reasonable under the circumstances” (Office of the Revisor of Statutes, Minnesota Court Rules)
- Minn. R. Prof. Conduct 5.1 — managerial responsibility to make reasonable efforts to ensure the firm has “measures giving reasonable assurance” of conformity with the Rules
- Minn. R. Prof. Conduct 5.3 — parallel responsibility as to nonlawyer assistants, including cmt. [3] on nonlawyers outside the firm and internet-based services
- Minn. R. Prof. Conduct 1.2(a) — “A lawyer shall abide by a client’s decision whether to settle a matter.”
- Minn. R. Prof. Conduct 1.4(b) — duty to explain a matter sufficiently “to permit the client to make informed decisions regarding the representation”
- Garner v. Kadince, Inc., 2025 UT App 80 (Utah Ct. App. May 22, 2025) (per curiam) — sanctions where an unlicensed law clerk used ChatGPT, signing counsel “did not independently check the accuracy of the Petition before signing and filing it,” and the firm had no AI policy; quoting Mata v. Avianca, Inc., 678 F. Supp. 3d 443, 448 (S.D.N.Y. 2023) on the “gatekeeping role” imposed by existing rules
- Al-Hamim v. Star Hearthstone, LLC, 2024 COA 128, 564 P.3d 1117 (Colo. App. Dec. 26, 2024) — declining to sanction a self-represented litigant for hallucinated citations while putting the bar on notice
- Ancker JS, Edwards A, Nosal S, et al., Effects of workload, work complexity, and repeated alerts on alert fatigue in a clinical decision support system, BMC Med. Inform. Decis. Mak. 2017;17:36 — reminder acceptance dropped 30% for each additional reminder per encounter (112 clinicians; ~1.27 million best-practice advisories and ~326,000 interaction alerts, 2010–2013)
- Gmail API,
users.drafts.create— creates a draft carrying theDRAFTlabel; transmission requires the separateusers.drafts.sendmethod - The publishing pipeline, gate findings, and pre-publish link checker described above are this firm’s own systems and work product from 2026-08-18–19; the assignment briefs, per-article manifests, gate reports, and
prepublish_check.pyare maintained in the site’s repository. No client matter is described anywhere in this article.
General commentary on practice management and legal technology — the opinions, including the prediction offered above with its failure conditions, are the author’s. Not legal advice and not ethics advice; whether any particular rule of professional conduct applies to a particular use of software is a question for a lawyer’s own analysis of their own jurisdiction and practice. No client information appears in this article; all operational examples are drawn from the firm’s own systems. Everything in this section is free — the only ask is that you use it to serve people who could not otherwise afford a lawyer. Questions about anything here: Send us a message or 612-470-6529.