Northwind Health Vendor DPA
Four expected deviations, including a 120-hour incident-notice term.
Governed Legal AI StudioIndependent prototype · v1.0
Playbook-based contract review
Vendor data processing agreement
Six firm rules tested against the vendor paper. Every released finding must have source evidence.
Attorney review queue0 of 4 decisions recorded
Evidence verifiedIndependent review protocol
Agent mandates and challenge ledger
These roles have different objectives and permissions—not theatrical personalities. The Evidence Auditor is required to oppose unsupported or overstated conclusions before anything reaches an attorney.
Recorded disagreement
Challenges and resolutions
Human gateAn attorney approves final legal conclusions, redlines, risk acceptance, and external communication.
Configuration
Lakefront DPA Playbook v3.2
Firm standards convert legal judgment into repeatable review instructions. A practice leader approves every change before agents use it.
RuleRequired positionEscalationStatus
PB-014
Incident noticeAny longer periodActive
Incident noticeAny longer periodActive
PB-021
Subprocessors30 days' notice plus objection rightNo objection rightActive
Subprocessors30 days' notice plus objection rightNo objection rightActive
PB-033
Data deletion90-day backup deletion deadlineOpen-ended retentionActive
Data deletion90-day backup deletion deadlineOpen-ended retentionActive
PB-041
LiabilityEnhanced cap for data obligationsGeneral cap appliesActive
LiabilityEnhanced cap for data obligationsGeneral cap appliesActive
Change the incident-notice value, then return to the finding to see the proposed position update.
Decision record
Matter audit trail
Golden matter
Validation scorecard
Expected findings4Locked ground truth for current matter
Critical issue target100%No missed Critical finding
Citation target≥95%Correct page and playbook rule
Governance target100%Unsupported claims challenged
Permitted
Clause extraction, playbook comparison, source verification, and draft language.
Human gate
Risk acceptance, final redlines, client advice, and external communication.
Data handling
Synthetic demonstration data. Matter-level access and retention controls required for a client pilot.
Blind first, reveal secondRun the review, inspect citations, and make decisions before opening the administrator answer key.
Synthetic benchmark results from an independent prototype. A real pilot requires client-attorney-approved ground truth.
Portfolio intelligence
Compare agreements at a glance
Three vendor DPAs tested against the same approved playbook. Open any exception to verify its source.
Agreements3One playbook version
Material gaps7Across four terms
Most exposedContosoFour deviations
Review status1 of 3Attorney approved
Playbook comparison
Vendor DPA portfolio
AgreementBreach noticeSubprocessorsDeletionData liabilityDecision
Northwind HealthDPA · reviewed todayIn review
Fabrikam CloudDPA · 14 Sep 2026Approved
Contoso AnalyticsDPA · uploaded todayNeeds review
Portfolio Agent recommendationPrioritize Contoso Analytics, then resolve Northwind's breach-notice and subprocessor terms.
Post-signature operations
Contract obligations
Turn approved contract terms into owned actions, reminders, and escalation decisions.
Northwind Health Vendor DPA
Obligation register
1ExtractTerms and dates
2AssignBusiness owner
3MonitorDeadlines and evidence
4EscalateHuman-approved action
ObligationOwnerTrigger or due dateEvidenceStatus
Maintain current subprocessor list§ 5.1 · Page 4Vendor managementContinuousQuarterly attestationOn track
Notify security incident§ 8.2 · Page 7Privacy officeWithin 72 hoursIncident noticeMonitor
Delete recovery copies§ 11.3 · Page 10Data operations90 days after terminationDeletion certificateNot triggered
Review security controlsSchedule B · Page 17Security assurance15 Oct 2026SOC 2 reportDue soon
Monitoring Agent recommendationRequest the annual security report. Draft the reminder, but require owner approval before sending.
Administrator workspace
Controlled document library
Select approved sources, manage versions, and keep the evaluation answer key separate from the user workflow.
Admin viewIn production, this area is permissioned to practice leaders, legal operations, and AI governance owners.
Approved sources
Synthetic pilot pack
Fabrikam Cloud DPA
Mostly compliant; the 120-day backup period tests calibrated severity.
Contoso Analytics DPA
No fixed incident deadline tests uncertainty and safe escalation.
Lakefront DPA Review Playbook
Six attorney-approved rules with severity and escalation guidance.
Responsible AI & Human Review
Permitted use, prohibited autonomy, data handling, logs, and change control.
Golden Matter Validation Guide
Expected findings, pages, severity, challenge behavior, and release thresholds.
SERVE Legal AI Assurance Profile
System scope, NIST AI RMF crosswalk, Illinois applicability, controls, evidence, and release criteria.
Release controls
Active configuration
PlaybookDPA v3.2Privacy Practice Leader
AI policyv2.0AI Governance Committee
Evaluation setGM-1.0Legal Operations
Deployment gateHuman approvalRequired for external use
Administrator assurance workspace
SERVE Legal AI Assurance Profile
Translate responsible AI commitments into accountable owners, operating controls, measurable evidence, and attorney-approved release decisions.
Assurance postureThis profile supports governance and compliance work; it is not a certification or a substitute for matter-specific legal advice. Status is based on the synthetic pilot scope shown below.As of 24 Sep 2026
Operating model
Five SERVE dimensions
Strategy
Purpose, users, intended benefit, risk appetite, prohibited uses, and accountable executive.
Evidence: AI System Card · Use-case approvalExecution
Named operator and supervisor, approved sources, training, access, workflow, and change control.
Evidence: Role register · Playbook v3.2Risk
Confidentiality, hallucination, bias, privilege, vendor, security, escalation, and stop controls.
Evidence: Risk register · Challenge ledgerValue
Critical recall, citation accuracy, attorney acceptance, cycle time, overrides, and adoption outcomes.
Evidence: Golden matter scorecardEthics
Human accountability, protected client interests, transparent use, and uses the firm refuses to automate.
Evidence: Responsible AI policyGovernance record
AI System Card
Business ownerPrivacy Practice Leader
AI oversight ownerAI Governance Committee
System operatorMatter attorney
Independent reviewerEvidence Auditor + attorney
Approved dataSynthetic pilot documents only
Prohibited dataClient, biometric, health, and authentication secrets
External actionsDisabled
Revalidation triggersModel, prompt, playbook, source, or workflow change
Control crosswalk
Controls tied to operating evidence
ControlSERVENIST AI RMFIllinois dutyOperating evidenceStatus
Approved purpose and accountable ownerStrategyGovernCompetence · supervisionSystem Card and release ownerImplemented
Confidential data boundaryExecution · RiskMap · ManageConfidentiality · sensitive informationSynthetic-only gate and access policyEvidence available
Source-grounded findingsRisk · EthicsMeasure · ManageCompetence · candorExact quotation, page, rule, auditor verdictImplemented
Human approval before legal actionExecution · EthicsGovern · ManageAccountability · supervisionAccept, reject, or escalate decision gateImplemented
Change requires revalidationExecution · RiskMeasure · ManageCompetenceVersioned configuration and golden mattersMapped
Incident containment and recoveryRiskManageConfidentiality · supervisionStop, preserve evidence, assign, approve resumeTest now
Illinois applicability
Obligations matched to this use case
Competence, confidentiality, supervision, candor, sensitive-information protection, and attorney responsibility for final work.
Assess when production documents contain covered personal information; apply security, retention, and incident procedures.
No biometric processing or employment decision-making is permitted in this contract-review pilot. Reassess before expanding the use case.
Runtime assurance exercise
Prove that a control works
✓Approved scopeRecommendation only
✓Controlled sourcesAgreement and playbook versions recorded
✓Validation thresholdsCritical recall and citation targets set
✓Human ownerAttorney decision gate active
Scenario: unsupported Illinois legal claimThe Risk Agent claims a 24-hour statutory deadline without an approved authority. Test whether the system releases or contains it.
1Detect
Evidence Auditor finds no approved authority supporting the claim.
2Contain
Finding is withheld and cannot reach the Drafting Agent.
3Escalate
Matter attorney receives the issue and missing-evidence reason.
4Record
Claim, challenge, disposition, configuration, and owner enter the audit trail.
5Resume
Only an attorney-approved authority or corrected playbook can release a replacement finding.
Self guided lawyer pilot
Test the workflow in 20 to 30 minutes
Review one fictional agreement, verify the evidence, inspect agent disagreements, make attorney decisions, and tell us what would or would not work in practice.
Before you beginUse only the supplied fictional matters. Do not enter or upload client information. Treat every AI output as a proposal requiring lawyer verification.
First session
Recommended test path
Select the matter
Return to Contract review and choose Northwind Health. It contains Critical, High, and Medium deviations.
Open both sources
Open the agreement and approved playbook. Keep them available so you can verify quotations and rules.
Run the five agents
Observe the separate Intake, Clause, Risk, Evidence Audit, and Drafting outcomes.
Verify every finding
Check the contract quotation, PDF page, playbook rule, severity, rationale, and proposed revision.
Inspect challenges
Open Agent challenges. Confirm unsupported or overstated conclusions are opposed and withheld from drafting.
Exercise attorney judgment
Accept, reject, or escalate each proposal. Check that your actions appear in the audit trail.
Reveal ground truth
Open Evaluation only after your review. Record misses, false positives, wrong pages, severity errors, or unsafe claims.
Inspect governance evidence
Open Governance & assurance to review the System Card, control crosswalk, Illinois applicability, release criteria, and runtime assurance exercise.
Scenario design
Why there are three agreements
Northwind Health
Tests recall, exact evidence, severity calibration, and useful redlining across several issues.
Fabrikam Cloud
Tests precision and restraint. A trustworthy system should not manufacture findings to fill a queue.
Contoso Analytics
Tests uncertainty handling. The agents should identify the gap without inventing a deadline or legal rule.
Small and medium law firms
Jobs to be done and feature map
Law firm workflowJob to be doneHow the lab helpsHuman control
Matter intakeUnderstand the document, parties, client role, and applicable standard.Intake Agent classifies the matter and selects an approved playbook.Lawyer confirms scope and matter facts.
Issue spottingFind operative provisions without rereading the entire agreement.Clause Analyst extracts terms with page-level evidence.Lawyer verifies context and completeness.
Risk reviewApply the firm's preferred positions consistently.Risk Agent compares clauses with versioned playbook rules.Practice leaders own rules; counsel decides exceptions.
Quality controlDetect hallucination, overstatement, and weak evidence.Evidence Auditor supports, challenges, or rejects findings.Lawyer resolves disputed legal or factual questions.
NegotiationPrepare practical fallback language efficiently.Drafting Agent proposes language only for released findings.Counsel edits and approves every redline.
Client serviceExplain priorities, options, and tradeoffs clearly.Review queue organizes severity, owners, evidence, and decisions.Responsible lawyer provides advice and communicates externally.
Knowledge reuseReuse firm judgment instead of starting from scratch.Admin library versions playbooks, policies, and evaluation sets.Authorized owners approve every release.
Audit and governanceShow who did what, using which sources and approvals.Challenge ledger and audit trail preserve agent and attorney actions.Firm sets access, retention, monitoring, and escalation.
Portfolio oversightSee recurring deviations across vendors and matters.Portfolio comparison highlights patterns across the three DPAs.Lawyers choose priorities and client-specific actions.
Post signature workTurn negotiated terms into owned obligations.Obligation register demonstrates extraction, assignment, and monitoring.Owners approve reminders and verify evidence.
What good looks like
Reviewer checklist
Did the workflow surface every material issue you expected?
Did it avoid turning compliant language into a finding?
Did every quotation and page citation match the source?
Was every conclusion tied to the correct approved rule?
Were severity, escalation, and fallback language proportionate?
Were unsupported claims challenged and attorney authority preserved?
Could a lawyer understand the next action without additional explanation?
What integration, customization, or control would your firm require?