Grace Nelson Law

I am responsible for the firm's information security and IT as a whole, not only the agent.

• Least-privilege Microsoft 365 and Microsoft Graph permissions
• Administrative access only over a private network
• A health check every five minutes; alerts carry identifiers only, never client names
• Self-hosted Wazuh security monitoring
• Nightly database copies to versioned off-site storage through an upload-only key, and daily disk snapshots
• Incidents written up with their root cause, and the fix recorded in the specification

An agent that reads a law firm's email handles personal data covered by professional secrecy, and every message it reads is untrusted input. The design started from the ways that could fail, and answered each one with a permission or a limit in code.

• An email tries to instruct the agent: it cannot send, drafts can address only the matched client, and a lawyer approves every reply
• A run mixes up two clients: writes are limited to the one client set for the event, and the tool refuses a second
• Mail claims to come from the firm: sender authentication is required for anything that does
• A run reaches other systems: a throwaway system user per run, with private and cloud-metadata networks blocked
• An alert leaks client data: alerts carry identifiers only, never client names
• Data is lost or encrypted: nightly copies to versioned off-site storage through an upload-only key, and daily disk snapshots

Every safety rule lives in the tools the agent calls or in the permissions it runs with. Instructions can be argued with; a missing permission cannot.

• No sending: the send permission was removed from the application and its consent revoked; a send attempt returns 403
• Recipients: drafts can address only the matched client, never third parties
• One client per run: writes are limited to the client set for the event, and the tool refuses a second one
• Narrow tools: a shell only for the pipeline's own commands, files only in the run's work folder, the knowledge base read-only
• Sandbox: a throwaway system user per run, private and cloud-metadata networks blocked, memory and process limits
• The lawyers' Outlook folders are theirs: the agent never moves, renames or deletes them

Grace Nelson Attorneys at Law is a family firm in Cuenca, Ecuador, working in English and Spanish for people who move to Ecuador, buy property there and settle their affairs: visas and residency, real estate, wills and estates. Most client contact is by email, and every answer needs the client's file, the firm's practice and the current rules at hand.

I was an associate attorney at the firm before I took over its technology, and that shaped the design: the lawyers keep every decision, while the system does the reading, the filing and the first draft.

Mail is sorted before any AI sees it: firm mail, web leads, clients, third parties and noise, with sender authentication required for anything claiming to come from the firm. Each remaining message starts one agent run with a 15-minute limit.

• Identifies the client and updates the client's profile and matter status
• Files attachments into the client's folder in OneDrive
• Reads the firm's cited knowledge base; anything researched from official sources is marked as unverified
• Checks Sent Items just before drafting and stops if a lawyer has already answered
• Writes an unsigned draft tagged as AI-drafted, using only approved document templates

The agent answers from a knowledge base in git, not from memory. Every figure names its primary source, such as the ministerial agreement or article, and the date it was checked; the full texts of the laws sit beside it. Research passes are fact-checked independently, and firm practice drawn from past correspondence goes in only when the firm's owner approves it.

The pipeline was written specification-first: a 4,800-line specification with 70 recorded design decisions and more than 100 revisions, built in ten planned stages. It ran in a test mode against a shadow database before going live, and the shadow was discarded at cutover rather than merged.

About 38,000 lines of Python with 2,869 automated tests. A deployment pauses the queue, waits for the running job, merges and runs the full suite before anything goes live.

Once a week the system compares each draft with what the lawyer actually sent and proposes lessons: a phrasing the firm prefers, a fee that changed, a step the draft missed. The firm's owner approves or rejects each one; 61 have been approved so far. Proposals that would carry a name, an email address or a phone number into the knowledge base are refused automatically.