How AI agents can act safely in a law practice

The word agent is doing a lot of work in legal tech right now. Strip the marketing and it means something specific: AI that does not just answer questions but takes actions — reads a filing, drafts a response, updates a task, proposes an email. That is a genuine step up in usefulness from a chatbot, and a genuine step up in risk, because an AI that acts can act wrongly with consequences that outlive the conversation.

The instinct of many lawyers — keep AI away from anything that matters — is understandable but unstable, because the value is precisely in the work that matters. The better question is the one firms answered for people long ago: not whether the junior can be trusted, but what supervision structure makes their work safe to rely on. You do not hand a first-year associate the firm's checkbook and signature authority. You give them defined assignments, limited authority, review before anything goes out, and accountability for what they did. AI agents deserve exactly the same architecture — enforced by software rather than by convention.

Here is how EdgeLex builds that structure, layer by layer, in its standing-delegation system for Lex, the platform's AI.

The instruction is compiled, confirmed, and frozen

A delegation starts as a plain sentence — the way you would actually brief a junior. Whenever a document is linked to this matter, summarize it and message me the key points. There is no workflow canvas to wire up and no automation language to learn. Lex compiles the sentence into a formal delegation: defined triggers, defined steps, defined limits. You review that compiled form and confirm it before it goes live — so what runs is not the AI's ongoing vibe about what you meant, but a specific instruction you read and accepted.

From then on the delegation is event-driven. It wakes when the firm's own events fire — a document lands on the matter, an email arrives, a deadline approaches — and does its work while you are in court. This is the standing-instruction model of delegation rather than the babysat-chat model: you say it once, and the system watches the matter so you don't have to keep asking.

Crucially, the instruction cannot drift. Delegation definitions are immutable and versioned: editing one creates a new version, history never mutates, and every run records exactly which version it executed. That sounds like a database detail until you need it. When you review something an agent did last month, the question of what its instructions actually were at the time has a provable answer. Supervision without that property is guesswork with an audit-trail costume.

Authority is a frozen allowlist, not a vibe

The second layer is the one that matters most when a model misbehaves. Each delegation runs with only the tools its definition names — a frozen, default-deny capability surface. A delegation created to summarize documents holds the tools for reading and summarizing. It does not hold the ability to send email, and so it cannot send email, no matter what the model decides mid-run, no matter how the text it is processing tries to steer it.

That distinction — cannot rather than should not — is the entire point. Instructions influence a model's behavior; an allowlist bounds it. A prompt that says do not send email is a request. An execution environment in which the send tool was never granted is a wall. When people ask what stops an agent from going rogue, the honest answer at the model layer is nothing, reliably. The answer has to live in what the agent is physically able to call, which is why EdgeLex freezes the capability surface per delegation rather than trusting the model to respect its scope.

A prompt that says do not send email is a request. An execution environment where the send tool was never granted is a wall.

Consequential steps pause and ask

Within its allowed tools, an agent still faces a line the platform draws for it: reads run freely, and anything that changes the world requires approval. Sending an email, filing work product, touching a deadline — consequential steps pause the run and ask a human. The finished work arrives as a reviewed deliverable in EdgeMessage, never as a surprise already sent.

This is the associate model again, made mechanical. A junior lawyer drafts the letter; a supervising lawyer approves it before it leaves the firm. Lex proposes; you approve. And the approval is an artifact on the record — so what was proposed and what was actually done are never conflated, and the claim that something went out traces to the named human who let it. Approving from a phone through EdgeMobile is the same governed act as approving at a desk, because the gate lives in the platform, not in any particular screen.

Runs are bounded, visible, and stoppable

Agents fail in mundane ways more often than dramatic ones — looping on a task that isn't converging, burning cost on a malformed input. EdgeLex treats runaway execution as a designed-for case, not an embarrassment:

• Iteration limits — a run gets a bounded number of steps, so it cannot loop indefinitely.
• Budget ceilings — a cost boundary per run, backed by the platform's real-time AI cost accounting, which attributes spend by user, model, and client matter.
• Progress checks — a run that stops making progress stops running, rather than idling expensively toward its cap.
• An Agent Control Center — every delegation, version, run, and delivery in one place, with pause, retire, and a kill switch.

The kill switch deserves its own sentence, because it is the control lawyers ask about first and vendors mention last. If the firm wants an agent stopped, it stops. Standing authority you cannot revoke instantly is not delegation — it is abdication.

The work lands on the ledger, like everyone else's

The final layer is accountability, and it is where most agent products quietly fall apart. A typical AI agent runs while you watch and evaporates when you close the tab — its output lives in a side panel, assigned to no one, tracked by nothing. In EdgeLex, every delegation run is created as a real task assigned to Lex on the matter. It appears in the same task list as the rest of the team's work, with status, history, and review. AI work becomes trackable and reportable exactly like an associate's work, because structurally it is handled like an associate's work.

The same holds when you delegate directly: assign Lex a task and it acknowledges on the task itself, works in a visible session, and returns a draft as an approval card. Every terminal state reports back — draft ready, needs your approval, or blocked with the reason. Silence is impossible by design, which is more than can be said for some human delegations.

Consider what that makes possible on a hypothetical matter like Hale v. Northstar Logistics: a standing delegation that, whenever opposing counsel files anything, verifies every authority they cite and briefs you. Each filing wakes the delegation; each run lands on the Hale task list under a frozen instruction version; the brief arrives as a deliverable for your review; and months later, the complete record of what the agent did, under which instructions, with whose approvals, is sitting on the matter where a supervising lawyer — or a court — can inspect it.

Supervision you already know how to do

Line the layers up and the shape is familiar: a confirmed, frozen instruction; authority limited to enumerated tools; mandatory review before anything consequential; bounded time and budget; work tracked on the firm's own ledger; and a supervisor who can stop everything at once. That is not a novel AI-safety doctrine. It is how a well-run firm already supervises people — translated into architecture and enforced without exception, every run, including the ones nobody is watching.

That is the standard worth holding the entire category to. An agent that acts under review, within granted authority, on the record, is a colleague you supervise. An agent that acts on trust is a liability you have not met yet.