Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is It Safe to Let an AI Agent Access Client Matter Files?
No, not when the agent reads the matter file into a model, because the model vendor then receives privileged client content that no consent form can un-send. Ask for parties and identifiers replaced with placeholders before the model reads the file, a named person approving each filing or send, and a record of what the model received.
A firm that lets an agent open a matter file hands a vendor's model the client's name, the matter number, the account digits and the advice that privilege protects. Opening one is the first thing a legal assistant does and the last thing a firm should do without knowing what the model reads. The ABA's Formal Opinion 512 treats inputting client information into a self-learning GAI tool as a disclosure that requires consent: "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool" (ABA, 2024). A consent letter settles the lawyer's duty, and it leaves open the separate question of what the model actually received.
The question that decides the firm's exposure is what the model reads when the file is opened, and that depends on how the page is rendered rather than on who approved the access. A firm can answer it with three facts: which values the model received, which person approved the filing or send, and what record left the system. Consent and vendor terms sit on top of those, which is why a firm can hold both and still be unable to describe a single run.
Key findings
- For an agent to be safe on a matter file, the parties and identifiers on the rendered page would have to be replaced with consistent tokens before any model reads it, so the run works from PARTY_001 and MATTER_001 while the real values stay on the lawyer's screen (What Is Render-Layer Tokenization?).
- It would also require a named person approving each filing, client send and record change, and an exported record of what the model received on each screen (What Is an AI Control Record?).
- The vendor pages reviewed do not describe which values on a rendered matter page reach the model; Florida's opinion instead puts the duty on the lawyer to ensure the provider is obligated to preserve the confidentiality and security of client information (The Florida Bar, 2024).
- ABA Formal Opinion 512 states that for a self-learning GAI tool "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool" (ABA, 2024).
- 1Password documents that in its browser design "the AI agent and underlying LLM never need to see nor handle the credentials," which keeps a typed password out of the model and says nothing about the text of a document the agent opens (1Password, 2025).
- A production LLM system was exploited when the client "automatically fetches the external image URL included by the attacker," a zero-click injection that needs no action from the person whose mailbox it reads (Reddy and Gujral, 2025).
What does an agent receive when it opens a matter file?
The record type on this page is a litigation matter file: a caption, the parties, a matter number and the privileged narrative a lawyer works from. An agent assigned to summarize new matters opens it in a document viewer or a matter management page, and the application draws those fields for the screen. Whatever the screen shows, the model receives, because a browser agent works from the rendered page rather than from the file's bytes.
An agent works through a queue without waiting at each page, which is what agentic AI means in the research record: systems "capable of pursuing goals autonomously by making decisions, taking actions, and adapting to dynamic environments without constant human oversight" (MIT Sloan Management Review, 2025). At the speed of that queue the context fills with matter content, and it travels into the summary, the draft memo and the transcript the vendor keeps.
The rendering path decides what is in scope. A file opened in a viewer the agent can see is a rendered page, and the names on it reach the model. A file handed to an API as an attachment, or read from a directory by a coding agent, never becomes a page, and no browser control sees it; the vendor receives the file itself, which is the disclosure the opinions describe. A firm that has not established which path its agent uses cannot say what the model received (What Is a Protected Browser for AI Agents?).
For the lawyer, the difference is between a model that knows the client's name and one that knows the dispute. Only the first is a disclosure of identity to a third party, and both need consent and terms (What Is the PII Wall?).
What do the ethics opinions require before client information reaches a model?
The ABA's Formal Opinion 512 is the reference point. For self-learning GAI tools, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool," and "all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use" (ABA, 2024). Formal opinions are persuasive, not binding.
Florida's Opinion 24-1 puts the duty in the same place. A lawyer "must protect the confidentiality of the client's information as required by Rule 4-1.6"; where confidential information would be disclosed, "it is recommended that a lawyer obtain the affected client's informed consent prior to utilizing a third-party generative AI program" (The Florida Bar, 2024). The opinion adds that lawyers should check that "the provider has an obligation to preserve the confidentiality and security of information," along with retention terms and any proprietary claim.
Both tests turn on what the provider receives. Consent is required because inputting the information is the disclosure, and the terms decide what the provider may do with it. An agent that opens a matter file and sends the rendered text to a model makes the provider a recipient, whether or not a person retyped it, and research on models and personal data finds them disclosing what they are shown (Is It Safe to Let Enterprise AI Agents Access Personally Identifiable Information?).
What the opinions describe is the consent, the terms and the provider's obligation, not a record of what the model read, so a firm can hold all three and still not describe a run. OWASP's entry for sensitive information disclosure makes the same point: "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, 2025).
What do the vendors themselves say?
The vendor pages reviewed describe identity, credentials and reach, not what a matter file's parties look like to the model once the file is open.
Okta's post states that "Cross App Access (XAA) is an open identity protocol that centralizes authorization in the identity provider," extended to MCP servers, which decides which applications an agent may reach and leaves open what the model reads inside them (Okta, 2026). 1Password's post on browser agents states that "the AI agent and underlying LLM never need to see nor handle the credentials," injected "if, and only if, the human approves the access," a custody design for typed credentials that does not describe the client names and matter text on a page (1Password, 2025).
SAP's guide states that "Joule Agents can access enterprise data and act across both SAP and third-party systems," reach that puts a matter file in the set of records an agent can open without describing what the model receives after it does (SAP, 2026). The AI Agent Index entry for IBM's watsonx platform records that "predefined guardrails and policies are enforced automatically," and the same entry found no dedicated user approval settings and no way to stop an agent mid-run, so the guardrails govern what the agent may do rather than what it reads (AI Agent Index, 2026).
A control that replaces the parties and identifiers on a rendered page before the model reads it is not described in the pages reviewed.
| Dimension | What the vendor documents | What a firm should verify |
|---|---|---|
| Identity and authorization | XAA centralizes authorization in the identity provider (Okta, 2026) | Which applications the agent may reach, and what the model reads on their pages |
| Credential custody | The agent and the model never see or handle the credentials, injected when a human approves (1Password, 2025) | Whether the design covers document text, not only a typed password |
| Reach across systems | Joule Agents access enterprise data and act across SAP and third-party systems (SAP, 2026) | Which systems hold matter files, and what the model receives from each |
| Guardrails and approval | Guardrails are enforced automatically; no dedicated user approval settings found (AI Agent Index, 2026) | Whether a named person approves a filing, and whether the run can be stopped |
| What the model receives | Not addressed on the pages reviewed | Which values on the rendered page reach the model, and which are tokenized first |
How does prompt injection reach a matter file an agent reads?
A matter file is not the only text an agent reads on the way to it. The same run opens email, opposing counsel's PDFs, a client's upload and the matter management page, and any of those can carry instructions the person never wrote. MIT Sloan Management Review describes the mechanism: "malicious instructions are embedded in a seemingly benign content, such as text or even images," and once the model processes that content, hidden instructions can hijack its behavior (MIT Sloan Management Review, 2025).
The exposure is measured: where no defense was in place, agents followed an injected instruction in 17.4% to 100% of tests, with a median of 51% across that set (How Often Do AI Agents Follow Injected Instructions?).
The production record shows that the reading step is enough. EchoLeak, tracked as CVE-2025-32711 in Microsoft 365 Copilot, worked when the client "automatically fetches the external image URL included by the attacker," with an allowed Teams endpoint used to get past the content security policy (Reddy and Gujral, 2025). The person whose mailbox it was did nothing; the client fetched, and the model read.
For a firm, the interesting part is what the hijacked run can collect. If the model has read the caption of a matter file, an injected instruction can ask for the parties and the matter number, and the answer is already in its context. If the model has read PARTY_001 and MATTER_001, the same instruction collects tokens, and the mapping sits outside the model. What Is Indirect Prompt Injection and How Does It Reach AI Agents? covers the delivery paths; the point here is that injection does not need to defeat the file, only the reading.
That is why an injection detector is not the answer to the title question. A detector can lower the odds that one page succeeds; it cannot change what the model already received from the last page. The exposure is set at the render, and the control that changes it decides which values are on the page the model is given.
What should a firm ask for in writing before an agent reads a matter file?
The written ask has to do two jobs: satisfy the opinions and establish what the model receives. Most vendor questionnaires do the first and stop, which is how a firm ends up with an approved tool and no answer to the second.
A firm can put seven questions in a schedule and require a written answer to each.
| What to ask for in writing | Why it decides the question |
|---|---|
| The purpose and scope of the consent, by matter type | Opinion 512 requires informed consent before client information goes into a self-learning tool |
| The provider's confidentiality obligation, its retention period and any claim of ownership over inputs | Florida's opinion asks the lawyer to confirm the obligation and check retention |
| What the model receives from the rendered screen, field by field | It separates a summary of the dispute from a copy of the client's identity |
| Which values are replaced with tokens, and where the mapping is held | A token with no custody rule is a pseudonym the vendor can reverse |
| The named person who approves a filing, send or record change | Approval is where the real value should resolve, not before |
| The record of each run, exported to the firm's own systems | Consent and terms describe the arrangement; the record shows the run |
| The path the work takes: rendered page, API upload, file share or MCP | A file that never becomes a page is outside a browser control |
The last question is the one firms skip. A vendor that says it does not train on the firm's data has answered the terms question and has not described the render path. The schedule should require the vendor to name the values on the matter page it would replace, and to demonstrate the replacement on a test file before the pilot starts.
Governance frameworks help a firm organize the answers but do not supply them. NIST's AI Risk Management Framework "is intended for voluntary use" and aims "to improve the ability to incorporate trustworthiness considerations into the design" of AI systems, which describes a process a firm can adopt and not a set of fields a vendor must disclose (NIST, 2023).
What does a governed environment change?
A governed environment moves the control to the page, before the model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so an agent working the matter file sees PARTY_001, MATTER_001 and ACCT_001 where the caption, the matter number and the account digits sit. Real values resolve only at an approved destination, at the moment of an approved action, so the client's name reaches the filing the firm approved and not the transcript.
A named person approves each filing, client send and record change (What Is Supervised Delegation?), and every screen the model was given, every action and every approval is written to a record that exports to the firm's own monitoring. The record is what makes the run reviewable after the fact, which is the artifact the opinions do not describe.
What it does not change is the lawyer's duty. Consent, the provider's confidentiality obligation and the supervision of the work remain the firm's, because the substance of the matter still reaches the model and the professional obligations attach to the representation rather than to the identifiers alone. The change is specific: the client's identity and account numbers stay off the model's side of the screen, and the firm can show what the model received.
That split is the difference between a control on identity and a control on content. RedactSure vs Okta: 2026 Comparison & Alternative sets out how far an identity provider's authorization reaches and where the rendered page takes over.
What the record shows
The values on the rendered page decide the answer, and the firm is accountable for them. A matter file read into a model carries the parties, the matter number and the privileged narrative into a vendor's context, which is the disclosure the ABA and Florida opinions ask a lawyer to consent to and to bound with terms; a file rendered as PARTY_001 and MATTER_001 carries the legal question without the client's identity, and a named approver and an exported record make each run reviewable. The vendor pages reviewed settle identity, credentials and guardrails and leave the page itself open, so the firm's protection has to sit where the page is drawn. A firm can test this on one closed matter with test values: ask the agent to summarize the parties, then read the transcript and the run record, and compare the names in the file with the strings the model received.
Methodology and limitations
This page rests on the Florida Bar's opinion and ABA Formal Opinion 512, vendor documentation from Okta, SAP and 1Password, research and standards from MIT Sloan Management Review, OWASP and NIST, a research index entry about an agent platform, and RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page.
None of the products on this page was tested for it. "Not described" means the pages reviewed; the vendor pages concern identity, credentials, reach and guardrails, not the values on a rendered matter page. Vendor features change and the page carries its date. The example describes a record type, a litigation matter file, not an organization. RedactSure is deploying now with enterprise and government customers.
Whether an agent's use of a matter file satisfies a firm's professional obligations belongs to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the firm's own records.
Frequently asked questions
Is it safe to let an AI agent access client matter files?
No, not when the agent reads the file into a model, because the model vendor then receives the parties, the matter number and the privileged narrative. The ABA opinion requires informed client consent before client information goes into a self-learning tool, and Florida's opinion recommends consent where confidential information would be disclosed. Neither opinion changes what the model reads. The answer changes when the parties and identifiers are replaced with tokens before the model reads the page and a named person approves each filing.
What does the model receive when an agent opens a matter file?
Whatever the application draws on the screen: the caption, the party names, the matter number, the account digits and the narrative of the dispute. A browser agent works from the rendered page, so the values on it enter the model's context and travel into every summary, draft and transcript the run produces. A file passed to an API as an attachment is worse, because the vendor receives the file itself. The only way to know which path a run took is to read its record or its transcript.
Do the ethics opinions require client consent before an agent reads a file?
For self-learning tools, the ABA's Formal Opinion 512 requires informed client consent before inputting information relating to the representation, and Florida recommends consent where confidential information would be disclosed. Both are professional obligations on the lawyer, not technical settings, and neither is binding in every jurisdiction. A firm that treats a signed consent as the whole answer has satisfied the first question and still cannot say which values reached the model on a given run.
Does single sign-on or an identity provider change what the model reads?
No. An identity provider centralizes authorization, so it decides which applications an agent may reach and under whose identity. It does not decide which fields the application draws once the agent is inside: a matter page reached through an authorized session renders the parties and the matter number exactly as it would for a person, and the model receives them. The control that changes what the model reads has to act on the page, after authorization and before the model's context is assembled.
Who should approve an agent's action on a matter file?
A named person at the firm, with a role the firm defines, for every filing, client send and record change. Approval is also where the real values should resolve, so the approver sees the client's name while the run works from the token. A queue, a threshold or a vendor's automatic guardrail is not an approver, and an audit log written after the action does not replace one. The approval and its time belong in the record the firm keeps.
What record should a firm keep of what the agent read?
One row per run: the page the model was given with its tokens, the action the run proposed, the name and role of the person who approved it, and the time of each step, exported to the firm's own monitoring. Consent letters and vendor terms describe the arrangement; they do not show a run. A screenshot of the page proves the opposite of what the firm wants, because it carries the values. The record should hold the tokens, and the mapping should stay outside it.
How RedactSure Keeps Client Identities Out of What the Model Reads
A firm that puts an agent on a matter file answers for every value the model receives, and access controls do not decide that. Florida's opinion asks the lawyer to ensure the provider is obligated to preserve the confidentiality of client information (The Florida Bar, 2024).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the viewer draws the parties and the account digits into the transcript. Inside, the same file renders PARTY_001, MATTER_001 and ACCT_001, so the agent works on the dispute while the client's identity stays on the lawyer's screen; a named person approves the filing, and the real values resolve only there.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A matter file that renders once as PARTY_001 keeps the client's identity out of every summary the run produces. Bring one closed matter and see, with test values, what the model reads, who approves the filing and what the record holds. Book a demo