Every firm putting AI into production is arguing about models, vendors, and confidentiality terms. Those are real questions. None of them is the big one.
The big one is where you draw a line, and every firm answers it whether it notices or not: what is an agent allowed to do without a human pressing the button?
Here’s my answer, and it’s a rule that runs everywhere in this firm’s stack: agents produce drafts and staged actions. A human fires anything that crosses the firm’s boundary. Every email. Every filing. Every posted time entry. Every dollar.
People tend to hear that as timidity. It isn’t. It’s not a phase, and it’s not caution I plan to relax as the models get better. They’ve gotten enormously better since I adopted it. Drafts-only is a permanent design choice, for the same reason a bank keeps dual control on wire transfers after thirty years of the teller never stealing a dime. The rule says nothing about how good the actor is. It’s about the gap between what a checkpoint costs and what an action you can’t take back costs.
And there’s a second payoff, the one lawyers ought to care about most. It’s the only setup I know of where the profession’s supervision duties get met at a place you designed, instead of on faith.
The rules already drew this line
Long before AI, long before software, the Rules of Civil Procedure picked the moment responsibility attaches. They didn’t pick drafting.
Minn. R. Civ. P. 11.02 provides:
By presenting to the court (whether by signing, filing, submitting, or later advocating) a pleading, written motion, or other document, an attorney or self-represented litigant is certifying that to the best of the person’s knowledge, information, and belief, formed after an inquiry reasonable under the circumstances: (a) it is not being presented for any improper purpose …; (b) the claims, defenses, and other legal contentions therein are warranted by existing law or by a nonfrivolous argument for the extension, modification, or reversal of existing law or the establishment of new law …
Look at what that rule regulates. Not writing. Presentment. You can write anything you want; a rough draft pushing a theory you haven’t researched breaks no rule. The certification attaches the instant the document crosses from your office to the tribunal, and it attaches to a person.
That’s drafts-only. It has been since long before anybody had a model to worry about. The paralegal who assembles the motion, the associate who writes the first three sections, the form book, the brief bank: none of them certify a thing. The signer does, and what the signer certifies is an inquiry reasonable under the circumstances.
So when I say the agent drafts and the human sends, I’m not pitching a shiny new safety framework for a shiny new technology. I’m just refusing to break something the profession has always had. The interesting engineering question is how you keep the checkpoint real when the work flowing through it goes up tenfold. Keeping it at all was never in doubt.
That’s exactly where firms are falling down right now.
A checkpoint with nothing behind it
In Garner v. Kadince, 2025 UT App 80, the Utah Court of Appeals sanctioned counsel over a petition for interlocutory appeal that cited fabricated authority. Read the details closely. They’re not the headline version.
An unlicensed law clerk at the firm prepared the petition using ChatGPT. One of the two attorneys had nothing to do with drafting it. As to the other, the court recorded that “Mr. Bednar did not independently check the accuracy of the Petition before signing and filing it with the court.” The firm, counsel acknowledged, “did not have any policy in place addressing the use of AI,” formal or informal, and only started writing one after the order to show cause came down.
Now look at what wasn’t missing. There was a human checkpoint. A licensed attorney signed. The signature was there and the human was there, and the result was still fake precedent in an appellate filing, opposing counsel’s fees, a refund of the client’s fees, and a $1,000 sanction.
Here’s the court on the duty, and it’s the line that will outlast the case:
[W]e emphasize that every attorney has an ongoing duty to review and ensure the accuracy of their court filings.
And, quoting Mata v. Avianca, Inc., 678 F. Supp. 3d 443, 448 (S.D.N.Y. 2023):
[T]here is nothing inherently improper about using a reliable [AI] tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.
Garner isn’t an argument against AI drafting. It’s an argument that a checkpoint is either a place where work happens or it’s theater. The Colorado Court of Appeals landed in a similar spot in Al-Hamim v. Star Hearthstone, LLC, 2024 COA 128, 564 P.3d 1117. It declined to sanction a self-represented litigant whose brief had hallucinated citations, and put “him, the bar, and self-represented litigants on notice” that future filings might not get off so easy.
So the problem is harder than “keep a human in the loop.” There was a human in the loop in Garner. The real problem: how do you build a checkpoint a busy person will actually perform instead of just clear?
I use four rules, and they’re in order of how much they matter.
Rule one: sort by consequence
The gut instinct is to sort by technology: the AI can use this system but not that one. That’s the wrong way to cut it, and you end up with policies that make no sense, where an agent can’t touch email but can rewrite a document that turns into an exhibit.
Sort by consequence. Ask two questions about the action, not the tool:
Can anyone outside the firm see it? Does it reach a client, an opposing party, a court, a bank, a credit reporting agency, a vendor? If yes, a human fires it, because outside the firm is where reputation, admissions, and waivers live.
Can you undo it cheaply? I don’t mean “is it reversible in principle”; every database row can be edited. Can you undo it before it matters, for next to nothing, before anyone has relied on it? A misfiled document in a matter folder, yes. A sent email, no. Recall is a fiction, and the recipient’s copy is the record.
Anything internal and cheap to undo, an agent can just do. In this firm that’s a lot of ground, and it’s where nearly all the productivity comes from: reading and labeling mail, pulling dates out of a scanned order, pulling statutes as raw HTML, summarizing a record, generating a report, drafting from the firm’s templates, searching case law, writing the first draft of anything.
Anything external or permanent gets staged. The agent builds the whole action and stops.
The boring consequence is that money always sits on the human side of the line. No exceptions, no matter the amount, because money is where undoing a mistake costs the most and the professional consequences are harshest. A probabilistic system has no business holding write authority over a trust account. I’ve made that point at more length about where deterministic code is mandatory.
Rule two: batch the approvals, or you’re training a reflex
Firms get this one wrong even when they get rule one right, and there’s good evidence for why.
Medicine already ran this experiment for us, at scale, with clinical decision support. Ancker and colleagues studied 112 clinicians and roughly 1.6 million alerts across a network of community health centers and found:
Likelihood of reminder acceptance dropped by 30% for each additional reminder received per encounter, and by 10% for each five percentage point increase in proportion of repeated reminders.
Thirty percent for every extra alert. A confirmation dialog doesn’t keep getting safer the more you add. Past some volume it makes things worse, because it builds the habit of clicking through. A system that asks a lawyer forty times a day whether it can proceed hasn’t created forty checkpoints. It’s created one reflex.
So the requirement isn’t “ask before acting.” It’s ask once, about everything, in a form a human can actually read. When this firm’s billing agent finds a day’s worth of uncaptured work, it doesn’t throw up forty prompts. It shows one table (matter, date, duration, narrative, rate) and asks for a single approval over the batch, with the option to strike lines. One document, one decision, one place where a person’s attention actually gets spent.
The rest works the same way. The day’s outbound correspondence gets reviewed as a set of drafts sitting in the mail client. Publication is one push. Intake is a conflict check plus a read-back of the captured facts before anything gets created anywhere.
Batching feels less safe. It’s safer, because the alternative is a person who’s stopped reading.
Rule three: the agent finishes the work, so saying yes is cheap
What it costs to approve decides whether approval is real. If saying yes means the human has to finish the job, the human will start saying yes without looking, or quit using the system.
So a staged action has to be complete. Not a proposal. The actual thing, built.
For email, the draft sits in the mail system, addressed to the real recipient, with the subject and body final. That’s baked into the plumbing, and it’s more than a habit: the Gmail API’s users.drafts.create method “[c]reates a draft with the DRAFT label,” and it takes a separate users.drafts.send call to transmit it. The agent holds a credential that can compose. Sending is a different call, and a person makes it, from their own mail client, after reading the thing. No amount of enthusiasm turns a draft into a sent message.
For time entries, the narrative is written, the matter is attributed, and the rounding the practice management system will apply has already been applied, so the number on the screen is the number that posts. For a filing, it’s a document that’s formatted to the court’s requirements and opens correctly, with the caption and signature block filled in, so the lawyer is left with the only job that takes a lawyer: reading it and deciding whether to certify it.
Put another way, the agent’s job is to boil the human’s decision down as close to pure judgment as possible. Every mechanical step left at the checkpoint fights for the attention the checkpoint is there to capture.
Rule four: you have to be able to audit it, and the gates have to be able to fail
A checkpoint you can’t reconstruct afterward isn’t a control. It’s a memory.
Log the staged action, the human decision, who made it, and when. Make it append-only, because the point is to answer questions later that you didn’t know you’d have. If a client asks why a letter went out on the 14th, the answer should be a record. A recollection won’t cut it.
And the gates that run before the checkpoint have to be able to report failure. This firm’s pre-publish link checker carries a comment in its own source explaining why it looks the way it does: it was rewritten after a set of shell loops “silently did nothing under zsh (which does not word-split unquoted parameter expansions), so link checks reported ‘safe’ without ever running.” The script’s docstring now records that “[e]xit status is meaningful: 0 clean, 1 problems found.”
That failure should scare you more than a bad draft. A bad draft is visible. A check that reports success without ever running is invisible, and it turns a real control into a ritual while every dashboard stays green. If your gate has never blocked anything, you don’t have evidence your work is clean. You have a gate nobody’s tested. I’ve written separately about checks that cannot fail and failures that say nothing, because between them they cause most of the quiet damage in automated systems.
What it looks like when it runs
Earlier this month this firm published thirty long-form articles on Minnesota law. That pipeline is this essay, running.
Five drafting agents worked in parallel from written assignments. Each one pulled statutes as raw HTML from the Revisor and read cases in full, not from search snippets. None of them could publish. Their output went to separate verification agents that hadn’t written the articles, working a four-pass protocol against primary sources: inventory, existence and accuracy, adversarial re-check, reconciliation. The drafter’s own citation manifest counted as a claim to test. It didn’t count as proof.
The gate reports show what that buys you. A pin cite corrected from page 634 to 635. A block quote that had quietly dropped a trailing clause, restored with an ellipsis added “so the inline quote is no longer presented as a closed sentence it is not.” A year in a case citation that an intermediate source gave as 1964, settled at 1954 only by pulling the original opinion itself instead of trusting the quoting court’s copy.
A lawyer reading for sense wouldn’t have caught any of those. They got caught because a second reader, one who didn’t write the piece, had to re-derive every citation from the source, and because the author of a claim was never allowed to be its verifier.
Then the build ran, the link check ran with an exit status that meant something, and a human pushed. Thirty articles, one trigger, one person on the hook.
The ethics rules
Does Minn. R. Prof. Conduct 5.3 govern software agents? Whether a rule written for “a nonlawyer employed or retained by or associated with a lawyer” reaches a model is a genuinely open question, and a Practice Lab essay isn’t where it gets settled.
What’s not open is the standard the supervision rules apply, and it’s about systems, not diligence. Rule 5.1(a) requires a lawyer with managerial authority to “make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that all lawyers in the firm conform to the Rules of Professional Conduct.” Rule 5.3(a) uses nearly identical language for nonlawyers. The key noun in both is measures. Not care, not attention, not good intentions. Measures, in effect, at the firm.
That wording does my argument a big favor. A firm can’t prove it was careful. It can prove that every outbound communication was composed as an unsent draft and sent by a named person; that no automated process holds credentials to move money; that citation checking is done by an agent that didn’t draft; that approvals are logged. Those are measures. You can describe them, test them, and produce them.
Compare Garner, where counsel had to tell an appellate court the firm had no policy at all. The problem there wasn’t a bad model. It was that there was nothing to point at.
Two neighboring rules matter too, because they name buttons that aren’t the lawyer’s to push either. Rule 1.2(a) provides that “[a] lawyer shall abide by a client’s decision whether to settle a matter,” and Rule 1.4(b) requires a lawyer to “explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation.” Some buttons belong to the client. A system that quietly moves one of those decisions into the firm’s workflow is wrong before you ever get to the technology.
Here’s how I’d know I blew this one
The real weak spot in drafts-only is that the human becomes the bottleneck. If an agent can stage more work than a lawyer can actually review, the whole thing slides into rubber-stamping with extra steps. Rubber-stamping with an audit log is worse than no automation at all, because it manufactures a paper trail for a review that never happened.
I think rules two and three handle that risk, and I’m not walking away from the model over it. But it’s the real risk, and it’s the one I watch. The warning sign is easy to spot: approval time per batch dropping while batch size climbs.
Here’s the version you can check me on. I predict that within five years, the malpractice claims and sanctions orders in this area will pile up overwhelmingly on firms that let agents act externally without a human trigger, and not on firms that were slow because a person had to read things. If the losses pile up instead on firms whose lawyers approved batches they couldn’t really review, then batching is the flaw, and the fix is smaller batches with harder gates, not fewer prompts. And if, five years from now, the firms with the best client outcomes and the cleanest discipline records are the ones letting agents send email and move money unattended, then I just got the asymmetry wrong, and it’ll be because undoing things got cheap in a way I didn’t see coming.
What wouldn’t change my mind: better benchmark scores. The rule never depended on the model being unreliable.
Why this is bigger than risk management
You could write this essay as pure defense: controls, exposure, sanctions. That version’s true. It’s also beside the point.
The point is that once you get the boundary right, you can go hard everywhere inside it. A firm that has decided exactly that nothing leaves without a person can let agents do an enormous amount of real work and nobody loses sleep over it. All the caution sits at one designed spot, and that’s exactly what lets the rest of the system move fast. Firms that never drew the line clearly end up cautious everywhere and slow everywhere, and they get a fraction of the benefit for the same amount of worry.
And the checkpoint isn’t overhead. It’s what you’re selling. A client isn’t buying documents. A client is buying a person who answers for them: the judgment about consequence, the license behind it, and the fact that when something goes wrong, somebody has to stand up and own it. Drafting was never the scarce part of this profession, and it’s about to get a whole lot less scarce.
That’s the hopeful read, and it’s why any of this gets published for free. If the cost of drafting collapses and accountability stays right where it’s always been, good representation gets cheaper without getting worse, and the gap between the people with legal problems and the people who can afford to do anything about them shrinks a little. But only if the profession keeps a human on the send button, and only if pushing it still means something.
Sources
- Minn. R. Civ. P. 11.01, 11.02 — signature requirement; certification arising from presenting a document to the court, “formed after an inquiry reasonable under the circumstances” (Office of the Revisor of Statutes, Minnesota Court Rules)
- Minn. R. Prof. Conduct 5.1 — managerial responsibility to make reasonable efforts to ensure the firm has “measures giving reasonable assurance” of conformity with the Rules
- Minn. R. Prof. Conduct 5.3 — parallel responsibility as to nonlawyer assistants, including cmt. [3] on nonlawyers outside the firm and internet-based services
- Minn. R. Prof. Conduct 1.2(a) — “A lawyer shall abide by a client’s decision whether to settle a matter.”
- Minn. R. Prof. Conduct 1.4(b) — duty to explain a matter sufficiently “to permit the client to make informed decisions regarding the representation”
- Garner v. Kadince, Inc., 2025 UT App 80 (Utah Ct. App. May 22, 2025) (per curiam) — sanctions where an unlicensed law clerk used ChatGPT, signing counsel “did not independently check the accuracy of the Petition before signing and filing it,” and the firm had no AI policy; quoting Mata v. Avianca, Inc., 678 F. Supp. 3d 443, 448 (S.D.N.Y. 2023) on the “gatekeeping role” imposed by existing rules
- Al-Hamim v. Star Hearthstone, LLC, 2024 COA 128, 564 P.3d 1117 (Colo. App. Dec. 26, 2024) — declining to sanction a self-represented litigant for hallucinated citations while putting the bar on notice
- Ancker JS, Edwards A, Nosal S, et al., Effects of workload, work complexity, and repeated alerts on alert fatigue in a clinical decision support system, BMC Med. Inform. Decis. Mak. 2017;17:36 — reminder acceptance dropped 30% for each additional reminder per encounter (112 clinicians; ~1.27 million best-practice advisories and ~326,000 interaction alerts, 2010–2013)
- Gmail API,
users.drafts.create— creates a draft carrying theDRAFTlabel; transmission requires the separateusers.drafts.sendmethod - The publishing pipeline, gate findings, and pre-publish link checker described above are this firm’s own systems and work product from 2026-08-18–19; the assignment briefs, per-article manifests, gate reports, and
prepublish_check.pyare maintained in the site’s repository. No client matter is described anywhere in this article.
General commentary on practice management and legal technology — the opinions, including the prediction offered above with its failure conditions, are the author’s. Not legal advice and not ethics advice; whether any particular rule of professional conduct applies to a particular use of software is a question for a lawyer’s own analysis of their own jurisdiction and practice. No client information appears in this article; all operational examples are drawn from the firm’s own systems. Everything in this section is free — the only ask is that you use it to serve people who could not otherwise afford a lawyer. Questions about anything here: Send us a message or 612-470-6529.