Matter Isolation for Legal AI Workflows

Technical architecture commentary — not legal advice. This article is a conceptual evaluation guide. It does not state that Nesthing has deployed any listed control, and it does not establish legal or regulatory compliance.

A law firm’s AI workflow may touch multiple clients, matters, teams, repositories, and external services. The design problem is not only where data is stored. It is how every retrieval, generated output, approval, and action remains associated with the correct matter and authority. MinLaw recommends organisational rules for data classification, handling, access control, approved tools, and human oversight (MinLaw, 2026).

Define the isolation unit

The firm should decide whether the control boundary is a client, matter, workspace, team, repository, or another approved unit. That boundary must be carried through identity, storage, retrieval, model context, tools, logs, and approvals.

If the workflow cannot determine the boundary confidently, it should not infer one from a filename or conversational context. It should route the item for review.

Test identity and access at every transition

A user who can view one system does not automatically have authority to send its data to another system or model. The workflow should evaluate the actor, matter, requested action, destination, and current permission before each material transition.

Temporary or scoped credentials may be considered as an architectural option, but any public statement about their implementation requires evidence of issuance, scope, expiry, and revocation tests.

Control retrieval context

Retrieval should begin from an approved matter scope. Broad semantic similarity alone can return information from an unrelated source if indexes or filters are misconfigured. OWASP’s GenAI security work is a useful technical reference for prompt injection, sensitive-information disclosure, and systems with excessive agency (OWASP Top 10 for LLM Applications 2026).

Candidate safeguards include explicit matter filters, separate indexes or namespaces, access checks before retrieval, source labels in outputs, and rejection of results that lack an authorised matter identifier. The appropriate combination depends on the deployment.

Keep generated content inside the boundary

Isolation continues after retrieval. Drafts, caches, temporary files, traces, and review queues can all create new copies of matter information. The design should document where these copies exist, who can access them, how long they remain, and how deletion or retention decisions are applied.

Unknown hosting, retention, subprocessor, and model-routing facts must remain unknown until verified for the specific configuration.

Gate cross-boundary actions

Moving content between matters, sending externally, changing access, or writing to a system of record should require explicit policy and, where appropriate, human approval. The approval should identify the source matter, destination, evidence, and permitted action.

Run adversarial acceptance tests

A controlled pilot should include tests designed to cross the boundary. A data protection impact assessment can also help an organisation identify and address personal-data risks before deployment (PDPC DPIA Guide). Candidate tests include:

similar names across two matters;
a user with access to only one matter;
a copied link from an unauthorised workspace;
retrieval queries likely to match another client’s documents;
expired or changed permissions during a run;
retries after a partial failure; and
an attempt to send content to an unapproved destination.

The expected outcome is not assumed. It should be specified, tested, recorded, and reviewed by the firm.

Matter isolation is therefore a lifecycle property, not a database checkbox. The control layer must carry scope and authority from intake through evidence, approval, action, and audit.

Evidence boundary

The controls above are architecture options for evaluation. The cited sources do not establish that Nesthing implements them or that a selected configuration satisfies legal, professional, security, or client requirements.