Data Boundaries for Legal AI Workflows

Technical architecture commentary — not legal advice. This article presents vendor-neutral design questions. Hosting, retention, subprocessors, security controls, and model routing remain configuration-specific facts that require evidence and approval.

Model selection is only one part of legal AI data handling. A controlled workflow must decide whether a particular item may leave its source system, what transformations are permitted, which destination is approved, and what may happen to the result.

These decisions should be policy inputs, not assumptions embedded in prompts. MinLaw recommends classifying information by confidentiality level and specifying which approved GenAI tools may be used for each category (MinLaw, 2026).

Classify before routing

A routing policy can consider the matter, data category, sensitivity, user role, intended purpose, destination, and requested action. If a required attribute is unknown, the safest operational outcome may be to stop and request classification rather than choose a route automatically.

The categories and rules must be defined by the firm. A generic label such as “confidential” is not enough if it does not map to an enforceable handling decision.

Minimise the payload

The workflow should send only the information needed for the approved task. Possible techniques include selecting relevant pages, removing unnecessary identifiers, separating instructions from source content, and using structured fields instead of entire files.

Minimisation does not itself prove compliance or security. It is a design principle whose implementation and effectiveness must be tested in context.

Make model routing explicit

A model-agnostic control layer can maintain an approved route for each task class. The route may include a model endpoint, region or environment, configuration, permitted data categories, retention setting, and fallback rule.

Fallback deserves special attention. When the preferred destination is unavailable, the workflow should not silently send information to a different model or region. It should follow an approved alternative or pause.

Control tools as well as models

An AI system may also call search, email, document management, practice management, or other tools. Each tool expands the action boundary. Read, write, send, delete, and permission-changing operations should be separately authorised.

Tool output should return to the same matter and evidence context. A successful connection does not establish that every possible action is permitted.

Preserve configuration evidence

Public or internal claims about hosting, retention, training use, encryption, subprocessors, or certifications need current evidence for the named provider and deployment scope. MinLaw’s vendor checklist asks firms to examine training use, retention, storage location, access controls, system compatibility, and auditability. A useful evidence record can include the source, date, configuration, owner, acceptance test, and review expiry.

If those facts have not been verified, they should remain unknown rather than be inferred from a vendor’s general marketing page.

Pilot the routing policy

Candidate tests include blocked sensitive categories, incomplete classification, an unavailable preferred route, an unapproved fallback, over-broad payloads, attempted write actions, changed permissions, and evidence expiry. PDPC’s DPIA guidance provides a structured basis for identifying and addressing personal-data risks (PDPC DPIA Guide).

The result should be a recorded decision for each case: allowed, transformed, routed for approval, or blocked. This provides a concrete basis for the firm to refine its policy before expanding the workflow.

A controlled data pathway is not a promise that information never moves. It is a documented and testable decision process governing when, why, where, and under whose authority it may move.

Evidence boundary

OWASP provides a current technical risk reference for sensitive-information disclosure and agent/tool security (OWASP Top 10 for LLM Applications 2026). These references do not verify any Nesthing provider setting, route, hosting location, or control.