Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can a Law Firm Use AI Agents Without Breaking Privilege?
Yes, when the vendor is bound as the firm's agent and the model receives tokens for the client's identity and the matter number, so it never learns whose matter it read. Where the vendor holds the file, the opinion puts the weight on consent and terms, so ask what the model receives and who approves each filing.
A client's file is the one asset a law firm cannot hand to a stranger, and an AI agent stays a stranger to the matter until the engagement and the technical arrangement make it something else. When the agent opens the matter page, the client's name, the privileged memo and the settlement figure sit in the context the model assembles, and the vendor holds a copy of work product the firm's duty protects. The ethics opinions address the lawyer's side of that: informed consent for a tool that learns, terms read and understood, a provider bound to confidentiality, and supervision that stays with the lawyer. They leave the technical side open: what the model receives from the page before it acts. A firm can settle that side with evidence, and the evidence comes from one record type, a litigation matter file in a document management system, where a partner asks an agent to summarize the file and draft the status letter. The difference between the two arrangements comes down to whether the vendor ever receives the names, the memo text and the figure at all.
Key findings
- For a law firm to put an agent on a client matter without exposing the file, the values on the rendered matter page would have to be replaced with consistent tokens before any model reads it, so the agent works the client as CLIENT_001 and the matter as MATTER_001 while the real names stay in a store outside the model (What Is Render-Layer Tokenization?).
- It would also require a named person approving each filing, client email or record change, and a record of what the model received that the firm can export to its own monitoring (What Is an AI Control Record?).
- The ethics opinions reviewed govern the lawyer's decision rather than the model's input, so a firm still has to establish for itself what a model receives from a client screen (ABA, 2024).
- The Cloud Security Alliance reports that "Eight in ten employees use AI tools not approved by their organizations", which is the shadow channel a firm's policy has to reach (Cloud Security Alliance, 2026).
- One analysis of refusal puts the limit plainly: "because the mechanisms of refusal are probabilistic, they're never likely to be all that reliable" (Holland Michel, 2026).
- Arcade's guide asks "Can this agent, acting for this user, perform this action on this resource?", a test of the action that leaves open what the agent read before proposing it (Arcade, 2025).
Does an agent's reading of a client file waive privilege?
Privilege protects the communication between a client and a lawyer, and it survives the people the lawyer needs to do the work: an associate, a copying service, an e-discovery vendor under a confidentiality agreement. The waiver question is whether a model vendor stands in that group. The opinion sets the consent bar: because many self-learning GAI tools could lead to disclosure, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool" (ABA, 2024). Whether a disclosure waives privilege is for the firm's counsel.
Where the vendor does receive the page, the answer turns on the engagement. The opinion states that, for a self-learning GAI tool, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool" (ABA, 2024), and it covers competence, confidentiality, client communication, candour, supervision and fees, leaving the vendor's terms to the lawyer's diligence.
The two duties are separate, and a firm can satisfy one while failing the other. Confidentiality is the broader obligation, and the Florida opinion restates the duty it applies: "a lawyer must protect the confidentiality of the client's information as required by Rule 4-1.6" (Florida Bar, 2024). Privilege is the narrower evidentiary protection, and a disclosure can cost it in a way a confidentiality clause does not cure. A hospital asks the same shape of question about a model vendor and patient records, where the definition turns on the data handled (Does an AI Model Vendor Need a BAA for Patient Records?).
What does the model receive when it opens a client matter?
On a rendered matter page, the model receives what the page draws. A document management system shows the client's name and contact details, the matter number, the privileged memo in the preview pane and the settlement figure in the matter summary. An agent asked to summarize the file reads the memo body, not a redacted abstract, because the page has no reason to hide it from a user allowed to see it. The same holds for a browser agent: the fields arrive in the model's context as text, and a screenshot carries them as pixels the model can read. Of the 15 AI agents and 86 AI security products reviewed, none describes replacing the values an agent reads on a screen with tokens it can work with, which is the substitution a client name and matter number need before the model reads the file (Do AI Agents Ask Before Making a Payment?).
The research record explains why one screen is enough. An agent's work can be moved off the task by instructions embedded in the content it reads, and the researchers "define this deviation as task drift" when injected instructions redirect it (Abdelnabi et al., 2025). A privileged memo is exactly the document a third party would like an agent to act on, and the agent cannot tell the memo's argument from an instruction planted inside it.
The pages that describe enterprise agents working on screens with personal data make the same point from the vendor side: the agent reads the rendered record, and the controls described govern the action it takes rather than the values it was shown (Which Enterprise AI Agents Can Work on Screens With PII Today, and What Does Each One Read?). Masking has to be consistent to be useful: replacing identifiers with consistent pseudonyms and restoring them after the model has done its work reduces semantic utility errors by a factor of five compared with baseline techniques (Does Masking Data on Screen Break Browser Agents?). A firm that wants to know what left the building has to look at what the page gave the model, not at the application's audit log.
What do the vendors themselves say?
Three vendor pages bear on this question, and each one governs a step beside the client file rather than the file itself.
OpenAI's data controls state that "Data controls let you choose whether your conversations help train OpenAI models", a setting about training rather than about what a model receives from a client's file (OpenAI, 2026). The same page says that with the setting off "your new conversations won't be used to train OpenAI models", which is a training choice rather than a statement about the model's context (OpenAI, 2026). For managed workspaces it states that "By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu, or ChatGPT for Healthcare workspaces to train its models" (OpenAI, 2026), which settles a retention question and not the question of what the model read.
1Password's post states that "the AI agent and underlying LLM never need to see nor handle the credentials" and injects them "if, and only if, the human approves the access", a credential the agent never handles, on a page that says nothing about a client document (1Password, 2025). It is the closest thing in the pages reviewed to a vendor stating that the model does not receive a value, and it governs a credential rather than the memo on the matter page.
Arcade's guide asks "Can this agent, acting for this user, perform this action on this resource?", a test of the action rather than of what the agent read before proposing it (Arcade, 2025). It adds that "Even if a user can delete files in Drive, their agent should only get read access unless deletion is explicitly needed", a scope for one action and not a rule for what a model reads on a matter page (Arcade, 2025). Both sentences govern the action the agent takes, and that reading is what a privilege review asks about.
| Question | OpenAI, per its data controls | 1Password, per its post | Arcade, per its guide |
|---|---|---|---|
| What the page governs | Training and retention for conversations | Whether the agent holds a credential a person releases | Which action an agent may take for a user |
| What the model receives from a client screen | The page does not address it | The page does not address it; the credential is the value held back | The page does not address it; the read is outside the question |
| What a firm should verify | Whether the workspace setting covers the tool it uses | Whether a client document is in scope at all | Whether the read is logged apart from the action |
What do the ethics opinions require before an agent reads a client file?
The two documents a firm is most likely to be shown are ABA Formal Opinion 512 and Florida Bar Ethics Opinion 24-1. The opinion adds that "all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use" (ABA, 2024). It warns that "lawyers may not abdicate their responsibilities by relying solely on a GAI tool to perform tasks that call for the exercise of professional judgment" (ABA, 2024).
The Florida opinion recommends that a lawyer "obtain the affected client's informed consent prior to utilizing a third-party generative AI program" where confidential information would be disclosed (Florida Bar, 2024). It also asks the lawyer to "Ensure that the provider has an obligation to preserve the confidentiality and security of information" (Florida Bar, 2024).
Neither text sets a technical control over what the model receives. The duties are duties about the lawyer's decision: consent obtained, terms understood, provider obligated, judgment retained. A firm can meet every one of them and still send a client's memo to a model that reads it in full. That is the gap this page found.
Supervision is where the opinions come closest to the screen, and the product pages reviewed show how thin the setting can be. The 2025 AI Agent Index entry for Breeze Agents records that "The default is that approval is required", though a user can switch it off (AI Agent Index, 2026). The combination that makes an agent dangerous is well defined: access to private data, exposure to untrusted content, and the ability to externally communicate (How Do AI Agents Bypass Company Data Protection Rules?). A default is a setting, and a setting is not a record of what the model read.
What should a firm ask a vendor about what the model reads?
Put the questions in writing and ask for an answer per workflow, because diligence is only as good as the evidence a firm can produce later. The first question is what the model receives from a rendered client screen: the page as the agent hands it to the model, not the audit log the application writes. Ask whether the values a matter page draws, the client's name, the memo text and the figure, are replaced before the model reads them, and where the real values live during the run.
The next questions follow the same axis. Who approves a filing, a client email or a change to a matter record, and is that person named in a record the firm can export? What does the vendor retain, and is the model trained on what the agent sends? Which identity appears in the vendor's logs? The four questions an agent review has to ask, what the AI saw, where it could go, what it did and what an attacker gets, are the frame for that list (What Should an AI Agent Security Review Cover?).
The vendor pages reviewed answer training and credential questions, and none of them describes a control over what a model receives from a rendered client screen, which is the limit this page found. The shadow channel makes the written answer more important: the Cloud Security Alliance reports that "Eight in ten employees use AI tools not approved by their organizations", which is the demand a firm's policy has to reach even when the approved tool is well governed (Cloud Security Alliance, 2026).
What does a governed environment change?
A governed environment is a control class that acts at the rendered page, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so an agent working a matter sees CLIENT_001 and MATTER_001 on every screen of the task. The mapping to the client's name and the matter number sits in a store the model cannot reach. A firm can add the settlement figure and other amounts to its policy. Real values resolve only at an approved destination, at the moment of an approved action, so the name reaches the filing portal and not the transcript.
For this page's question, that changes what the firm has to prove. The ethics opinions ask the lawyer to obtain consent, read the terms and supervise the work. A firm that does those things and sends the page anyway is relying on the engagement to hold. A firm whose agent works the page as tokens can show, screen by screen, that the client's name and the matter number in the memo never entered the model's context. The opinion also records that "there are uses of self-learning GAI tools in connection with a legal representation when client informed consent is not required because the lawyer will not be inputting information relating to the representation" (ABA, 2024). Tokens replace the client's name and the matter number, so the firm's counsel still decides whether the consent analysis applies to the rest of the file.
Detection at the model level is not the control this class relies on: "because the mechanisms of refusal are probabilistic, they're never likely to be all that reliable" (Holland Michel, 2026). A classifier that catches most attempts leaves the page's values in the context for the attempts it misses.
The approval and the record complete the class. A named person approves each filing and record change, and every screen as tokens, every action and every approval is written to a record the firm can export. The comparison pages for the vendors here describe the same class from the product side, including the Arcade page for agent actions (RedactSure vs Arcade: 2026 Comparison & Alternative).
What the record shows
At a rendered client matter page, the control that answers this question replaces the client's name and the matter number with consistent tokens before any model reads them, keeps the mapping outside the model, and releases the real values only at the destination a named person approved. Whether a firm gets there by that route or by an engagement that binds a vendor to confidentiality, the law asks the same thing of the lawyer: consent, terms understood, supervision, judgment retained. The ethics opinions reviewed set those duties and stop at them; the technical question, what the model received, is the one a firm answers with its own setup. A firm can settle it with one test on one matter: give an agent a live matter page with a client's name and a memo in it, then read the vendor's transcript and the page side by side, and if the name and the memo text appear in the transcript, the firm is relying on its contract rather than on the environment.
Methodology and limitations
This page rests on two ethics opinions, one read directly from the American Bar Association, vendor documentation from OpenAI, 1Password and Arcade, a research note from the Cloud Security Alliance, and a preprint, a dataset entry and one press analysis. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them.
No product was tested for this page, and none of the named products was run on a client matter. The products are described from their public documentation, and "not described" means the pages reviewed at those dates. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a litigation matter file in a document management system, and not an organization.
Determinations about whether a particular use meets a privilege, confidentiality or bar requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the firm's own screens.
Frequently asked questions
Can a law firm use AI agents without breaking privilege?
Yes, when the vendor is bound as the firm's agent and the model receives consistent tokens for the client's identity and the matter number, so the vendor never learns whose matter it read. The ethics opinions reviewed put the decision on the lawyer: informed consent where a tool learns, terms read and understood, a provider bound to confidentiality. Those duties are compatible with the agent, and the cleaner position is a vendor that holds no client content at all. The engagement and the run record are what let the firm show which position it is in.
What does the model receive from a client matter screen?
Whatever the page draws. A document management system renders the client's name, the matter number, the memo preview and the settlement figure, and an agent asked to summarize the file reads the memo body rather than a redacted abstract. A screenshot carries the same values as pixels. The application's audit log records that the agent opened the matter, not the fields it read, so the transcript and the page have to be compared after a test run.
Can a training opt-out change what the model reads?
Not by itself. A training setting governs whether conversations are used to improve a model, and a managed workspace default can exclude that content from training. That answers a retention and training question. It does not change what the model receives when the agent opens the matter: the client's confidential content is in the context before any training decision is made, and a model that never receives it needs no opt-out.
Who should approve an agent's filing or client email?
A named person at the firm, before the action leaves it. An approval setting inside the agent is useful and is still a setting, one a user can switch off. What the firm needs is a record that names the approver, the action and the page the model read. The approver's judgment is also the part of supervision the ethics opinions ask the lawyer to keep, and it does not transfer to the model.
What record should the firm keep of what an agent read?
A per-run record that shows the page the model was given, the tokens on it, the action the agent proposed and the name of the person who approved the action. The application's log and the vendor's transcript are different artifacts, and neither is written at the render layer. The firm should be able to export the record to its own monitoring, compare it with the page after the run, and keep it for as long as its engagement terms require.
Does a confidentiality clause in the vendor's terms settle what the model reads?
Only for the party it binds. A clause that obliges the provider to preserve confidentiality is one of the duties the Florida opinion asks a lawyer to check, and it is worth having. It governs the vendor's conduct after the content arrives. It does not change what the model received on the matter page, and a firm that wants the stronger position has to show that the content never arrived, which is a property of the page and the run, not of the contract.
How RedactSure Keeps the Client's File Out of the Model
An agent that reads a client matter has already received the file, and the ethics opinions leave the firm to prove what the model saw. The Florida Bar states the duty without a technical remedy: protect the client's information under Rule 4-1.6.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the matter page, reads the client's name and the matter number, and the vendor's transcript holds both. Inside: the page renders CLIENT_001 and MATTER_001, the mapping stays outside the model, and the real values resolve only at the filing portal, on the partner's approval. Every screen, action and approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Whether an agent can work a client matter without the file entering its context is what a privilege review now turns on. Bring a matter and see, with test values, what the model reads and where the real value lands. Book a demo