What Is an AI Agent for Lawyers? Agentic Legal AI Explained, With the Supervision Rules

Legora’s launch text for its “agentic operating system” is the pitch every vendor now makes: “A party sends a contract redline at midnight. By the time the lawyer sits down the next morning, the Legora Agent has already reviewed every change, flagged the issues that need attention, and drafted a response ready to send.” That was 7 May 2026. Harvey says it is “agentic by design” and counts more than 700,000 agent tasks a day; Thomson Reuters rebuilt CoCounsel Legal as “a fully agentic AI experience”; Microsoft put a Legal Agent inside Word.

A member of a large firm’s innovation committee read the same pitches and wrote on r/legaltech: “the ‘legal skills’ are basically system prompts + tool calling. That’s not legal reasoning.” Both are right. AI agents for lawyers are neither magic nor marketing: they are software that can plan, act and use tools while you are not watching, which is why the supervision rules matter more than the demo.

It is early. Thomson Reuters’ 2026 AI in Professional Services report found 15% of organisations using agentic AI and 53% planning to; the Law Society’s April 2026 report found “no evidence that agentic AI is currently being used in legal practice”; Gartner expects 40% of agentic AI projects, across all industries, to be cancelled by the end of 2027. Yet 47% of Thomson Reuters’ legal respondents think agentic AI should be used for legal work; one of them added that it “removes oversight a step too far. I like the idea of prompting and reviewing a result.”

Chatbot, workflow or agent: the difference that matters

Legora’s definition is the cleanest in the market: “A chatbot receives a question and provides an answer. It’s assistive technology. It helps you work. An agent receives a task, creates a plan of action, executes the plan, and returns a result. It’s execution technology. It does the work, end-to-end.” A chain of fixed steps is “automation… not agency”. The practical test is what the software can do without you.

The last row is the whole subject. A chatbot’s error sits in front of you; an agent’s may sit in step three of seven, in a document it retrieved and you never opened.

What agents do today: the 40-page redline and the 800-email chronology

The 40-page redline. Zack Shapiro of Rains LLP, a two-lawyer firm, uploaded a 40-page counterparty markup to Claude Cowork, where a contract-review skill organised the changes by severity and proposed counter-language; he decided what to accept; Claude then wrote tracked changes into the .docx under his name and drafted the client email. “Total time… under an hour, of which about 30 minutes is my own thinking” (Shapiro on X). Note the gate in the middle: the agent stopped, the lawyer chose, the agent acted.

The 800-email chronology. In Harvey, a litigation team uploads the emails to Vault, builds a review table with up to 50 columns of plain questions (“Who is the sender?”, “Does the email mention travel on Air Force One?”) and runs it; 800 emails yielded “4,000 data points at once in minutes”, each cell linked to its source (Harvey). The quieter in-house version is scheduled, narrow and read-mostly, which is what a first agent should be:

You are a scheduled agent running on the first Monday of each month over the folder <contracts>. Access is read-only; you may write one file, renewals-[date].md, to <output>.
For every agreement, list any renewal date, non-renewal notice deadline, price-increase date, expiry or option window in the next 120 days. Columns: Contract | Counterparty | Event | Date | Notice required by (show the calculation) | Clause quoted verbatim | Owner. Mark deadlines within 14 days URGENT. Include agreements where you could not determine a date and say why.
Do not send emails, create calendar entries or edit any agreement. If a clause is ambiguous, say so. Everything you produce is a draft for a lawyer's review.

“90 days before the anniversary” is a calculation; check the arithmetic yourself, because models miscount.

The platforms: Harvey, Legora, CoCounsel, Protégé, Microsoft and Claude

Two things stand out. The vendors run on the same few frontier models (Thomson Reuters built on Claude’s Agent SDK; Harvey’s own BigLaw Bench scores Claude Opus 4.7 at 90.9%), so what you buy is the scaffolding: playbooks, source links, matter isolation, audit trail. And the verification features are narrower than their names: Shepard’s Verify Trust Markers confirm a citation exists, not that it supports the proposition. See Harvey vs Legora vs CoCounsel and, for the 93 open-source agents, Claude for lawyers.

Tools, MCP and the context/action gap

An agent is only as useful as what it can reach. The Model Context Protocol (MCP), open-sourced by Anthropic in November 2024, lets an agent read your document management system and act in other tools. iManage’s MCP server (14 May 2026) lets Harvey, Legora, ChatGPT, Claude, Copilot “or a firm’s own AI agents” reach governed content, “authenticated, permission-bound, and fully logged” (Legal IT Insider).

Legatics’ Liam Reid describes the two gaps MCP closes, context and action: “It can flag a missing condition precedent but not update the closing checklist. The lawyer becomes the messenger between the AI and every other system” (Artificial Lawyer). The plain-English version is in MCP for law firms explained. Legal IT Insider adds the caution that matters for supervision: if the DMS layer feeding an agent is itself AI-generated, “two generative engines are working sequentially on the same source documents… errors do not just add; they compound.”

Governance: Harvey’s six dimensions

Harvey’s June 2026 agent guide names six dimensions on which any agent should be governed: scope of access (what it can read), authorised actions (what it can do), reviewability (can a lawyer check each step), matter-level isolation (no bleed between clients), deployment governance (who may publish an agent to whom) and accountability (whose name is on the output) (Harvey). Its sharpest line: “Publishing an agent is closer to writing a policy than to sharing a document.” GC AI’s rule is the same idea from the in-house end: “An agent you can trust is a workflow you already standardized, running on a schedule, with your name still on the review”; for ethics purposes it treats the agent as “a fast non-lawyer assistant” under ABA Model Rule 5.3.

I want to delegate this task to an agent: [describe the task in one paragraph]. Before anything runs, write a one-page scope under these headings: Access (folders, systems, documents it needs, and those it must not see); Actions (permitted without asking: read, extract, draft into a review folder; forbidden: send, file, sign, edit originals, route for e-signature, change permissions); Escalation (when it must stop and ask me); Review (what I check every run, what I sample, how each finding is cited so I can open the source); Record (what is logged per run: prompt version, model, documents touched, reviewer, date); Kill switch.
Flag any point where the task cannot be done safely without a human step.

Supervision: COPRAC’s agentic guidance, Rule 5.3 and SB 574

The State Bar of California’s Practical Guidance, rewritten in 2026, addresses agentic AI at the California Supreme Court’s request: “Lawyers must not permit AI systems to autonomously file documents, communicate with the court, or make representations on the lawyer’s behalf”; “The greater the level of system autonomy, the greater the lawyer’s obligation to implement oversight mechanisms”; “The lawyer’s duty of candor to the tribunal cannot be delegated to AI”.

California is also amending Rules 1.1, 1.4, 1.6, 3.3, 5.1 and 5.3 (second comment period closed 6 August 2026); proposed Rule 3.3 would require lawyers to “verify the accuracy and existence of cited authorities”. Senate Bill 574, passed on 31 August 2026 and awaiting the Governor, would bar delegating the practice of law to generative AI. Elsewhere the framing is supervision: ABA Formal Opinion 512 runs AI through Rules 5.1 and 5.3, and the SRA’s warning notice of 17 August 2026 opens with “AI has no separate legal personality”. The Ninth Circuit, sanctioning two lawyers in June 2026, stated the human minimum for every agent output: “A competent and diligent attorney must also read and reason” (Lnu v. Blanche). The jurisdiction map is in AI ethics rules for lawyers by jurisdiction.

Failure modes: prompt injection, compounding context, efficient-not-complete

Prompt injection. Any agent that reads a document reads the instructions inside it; a counterparty redline or an opponent’s brief can carry text meant for your agent. The defence is architectural: read-only access, no external actions, a human who opens the source.

Compounding context. If your DMS summaries are AI-written and your agent reasons over them, a wrong summary becomes a confident finding two steps later. Ask for the source passage, not the summary.

Efficient, not complete. Harvey’s benchmark team: research agents’ “bias is to search efficiently, not completely.” Farrell Fritz’s illustration: 47 change-of-control provisions extracted, three invented from neighbouring language, two real triggers in side letters missed. Ask what the agent did not find.

Here is the output of an agent that [reviewed the counterparty's redline / extracted change-of-control clauses / built a chronology]: <output>. Here are the source documents: <sources>.
For every finding, quote the exact words in the source that support it, with file name and clause or page; mark any finding with no supporting passage NOT SUPPORTED. Then list documents in <sources> the output never cites, anything in the sources that contradicts the output, and anything the agent assumed rather than read.
Finish with the three findings most likely to be wrong, so I open those first. Do not add findings of your own.

A supervision protocol: “Agents do not sign documents. Lawyers do.”

That is Harvey’s sentence, from a vendor with every incentive to sell autonomy. The same guide does the associate arithmetic honestly: a first-year who once spent 40 hours marking up a services agreement “might now spend 5 hours reviewing an agent’s markup”, and firms should build “intentional friction” so that craft does not die. A companion Harvey post published the same day puts it in five words: “The skill shifts from editing to auditing.” What that means for hiring is in Will AI replace lawyers? and AI-native law firms explained. Auditing, done properly, is a protocol:

1. Standardise before you automate. If two lawyers would run the task differently, an agent will run it a third way. Write the playbook; the agent runs the playbook.
2. Write the scope as a policy (the prompt above) and publish the agent the way you would publish a policy.
3. Read-only first. Version one reads and drafts into a review folder. Writes, sends and filings are a later version, if ever.
4. Test on history. Run it on three closed matters where you know the answer and compare with what the lawyers found.
5. Demand a citation per finding, and ask what it did not find. Open every finding that changes advice; sample the rest in stages, the way Reed Smith validates AI document review (50 to 100 documents, then 500 to 1,000, then the full set).
6. Log every run and re-test when the model changes. Prompt version, model, documents touched, reviewer, date. Agents inherit prompt fragility: “a model will update and I will need to tweak the prompt again”, as one r/biglaw lawyer put it.

A small firm does not need Harvey for this. Anthropic’s open-source scheduled agents, the recipes in no-code automation for a small law firm and a Claude Cowork folder are enough to run the protocol on an anonymised task; the prompts above are in the prompt library. That is what the platforms-and-agents session of AI Lab for Lawyers is for: we run a task on anonymised documents, then write the scope document before anything runs unattended.

Where to go next: lawyers who build their own agents and tools are in vibe coding for lawyers, and what agents mean for careers is in the careers and future hub.