New-matter intake agent with scoped tools and approval gates
An agent reads an intake email, runs a conflicts search with read-only tools and drafts the matter — but cannot open it until an approver signs off, enforced server-side.
The problem
Tool-using agents are where AI prototypes most often go wrong in practice: the model is given write access and asked nicely not to use it. This prototype inverts that. The agent gets the narrowest tools that can do the job, every action is logged, and the one consequential action — opening a matter — is physically unavailable until a person with the right role approves.
Constraints
- Synthetic client and adverse-party database (~500 entities) seeded with near-duplicates such as “ACME Logistics LLC” and “Acme Logistic Inc.” so fuzzy matching is tested, not assumed.
- Search tools are read-only. The draft tool writes only to a staging table.
open_matteris callable only after an approval record exists for that draft, and the check lives in the API, not in the prompt.- Sign-in through an enterprise identity provider with two roles: requester and approver.
Planned architecture
- Intake accepts a pasted email; the agent extracts parties, matter type and requested timeline.
- Tools:
search_clients,search_adverse_parties(read-only, fuzzy),draft_matter(staging only),request_approval, andopen_matter(gated). - Approval is a role-checked endpoint; the approver sees the draft, the matches found, and the agent’s reasoning before deciding.
- Audit log: one structured JSON record per run — every tool call, its arguments, a hash of the result, token counts and cost — with personal data redacted, shown in an audit view in the interface.
- Identity: Microsoft Entra ID with app roles; a session-role fallback is documented for local development.
Evaluation plan
Twenty scenarios with seeded conflicts of varying difficulty.
| Measure | How it is scored |
|---|---|
| Conflict recall | Seeded conflicts the agent surfaced |
| False-positive rate | Clean scenarios flagged as conflicts |
| Escalation | Ambiguous matches correctly routed to a person rather than resolved by the model |
| Failure handling | Database timeout, malformed input, and a prompt-injection attempt to skip approval |
| Gate integrity | A test that asserts open_matter never fires without an approval record |
| Latency and cost | p50 and p95 per scenario; cost per scenario |
Human review points
One, and it is mandatory: the approver. The agent can recommend; it cannot open.
Known limitations going in
- Fuzzy matching on names is a known weak point in real conflicts systems; the near-duplicate seeds are there to make the numbers honest, not flattering.
- Identity integration is time-boxed. If the enterprise login proves slow to configure, the first version ships with session roles and documents the integration as the next step.
Changelog
- v0.0 — Oct 13, 2026. Plan published. Build starts.