For most of the past two years, legal AI meant a chat window. An attorney asked a question, a model answered, and a person decided what happened next. Agentic workflows are a different proposition: software that plans and executes multi-step work toward a goal. It gathers the documents, runs the extraction, compares the drafts, writes the summary, and files it where the matter team will find it. Nothing human happens between step two and step five unless somebody designed a checkpoint there.
That shift from answering to acting is why governance is now the interesting question. A model that drafts a weak paragraph costs minutes. An agent that updates the wrong obligation register, or sends a summary to the wrong distribution list, creates a problem with a client's name attached. The firms deploying agents well are not the ones with the most capable models. They are the ones that decided, precisely and in writing, what an agent may do before the first one ran.
What an agentic workflow actually is
The term is doing heavy marketing duty at the moment, so a concrete definition helps. An agentic workflow is software that decomposes an objective into steps, executes those steps with tools (retrieval, extraction, comparison, drafting), evaluates intermediate results, and carries context forward until the objective is met or a rule says stop.
Asking what the survival period is in a stock purchase agreement is a prompt. Reading a data room index, identifying every agreement with a change of control provision, extracting the relevant clauses, comparing them against the client's standard positions, and producing an issue list with citations is a workflow. The first is a question. The second is work.
The distinction matters legally as much as technically. A prompt has a human at both ends. A workflow has a human at the start and, if it is designed well, at defined checkpoints along the way. Everything between checkpoints happens at machine speed, which is the value, and without contemporaneous human judgment, which is the risk.
Where agents already earn their keep
The workflows worth automating first share a shape: high volume, well defined inputs, and an output a lawyer would have reviewed anyway.
- Intake classification and conflicts pre-screening. An agent reads an inbound engagement request, identifies parties and affiliates, runs them against the conflicts database and the matter history, and hands the conflicts team a pre-screen memo. People still clear conflicts. The agent removes the assembly work underneath the decision.
- Diligence issue sweeps. Given a data room and a checklist, an agent sweeps every agreement for assignment restrictions, consent requirements, and termination triggers, then returns an exceptions list with clause-level citations for associate review.
- Obligation register maintenance. After signing, an agent extracts covenants, notice requirements, and deadlines from the executed documents and keeps the register current as amendments arrive. We wrote separately about why closing conditions slip; this is the workflow that stops it.
- Draft, compare, revise loops. An agent produces a first draft of ancillary documents from firm precedent, compares the draft against the negotiated term sheet, flags deviations, and revises against reviewer comments, with an attorney approving every turn.
None of this replaces legal judgment. It replaces the hours of collection and collation that sit underneath legal judgment, which is where associate evenings currently go.
The governance architecture that makes agents deployable
A firm can buy agent capability off the shelf. What it has to establish is the control surface around that capability. The same six controls appear in every deployment that survives contact with a risk committee.
- Scoped permissions. An agent holds a role with least privilege. It inherits matter-level ACLs and ethical walls from the systems it reads, and it can never see what its requesting user cannot see. If the associate who launched a sweep is walled off from a matter, so is the agent acting on their behalf.
- Bounded autonomy. A playbook defines what the agent may do without a human. Read and summarize, yes. Write to a matter workspace, usually. Send external email, file anything, or alter a document of record, never. The boundary is written down, versioned, and enforced by the platform rather than by training slides.
- Approval gates at consequential steps. Anything client-facing and anything that changes a document of record pauses for a named person. The gate shows the reviewer what the agent did, what it proposes to do next, and the sources behind both.
- A complete audit trail. Every retrieval, every intermediate output, and every tool call is logged, reviewable, and attributable to the initiating attorney. When someone asks how a conclusion was reached, the answer is a record, not a reconstruction.
- Kill switches and rollback. A supervising attorney can halt a running workflow immediately, and anything the agent wrote can be reverted cleanly. An agent that cannot be stopped mid-run is not enterprise software.
- Evaluation before production. Golden-set testing against matters with known answers establishes a quality baseline before an agent touches live work. Drift monitoring afterward catches degradation when models, prompts, or source data change.
None of this is agent-specific plumbing. Access enforcement and audit are the same fabric that should already govern search and chat, which is why Reframe builds them into the platform layer instead of rebuilding them inside each workflow. The enforcement model is described in detail on our security page.
Supervision is a duty, not a feature
The professional responsibility question is more settled than most panel discussions suggest. ABA Model Rules 5.1 and 5.3 already require lawyers to supervise nonlawyer assistance and to make reasonable efforts to ensure the work is compatible with the lawyer's own obligations. The useful move is to treat an agent exactly that way: as a very fast assistant with no judgment, whose work a responsible lawyer reviews before it counts.
Supervising an agent is not a new obligation. It is Rule 5.3 thinking applied to an assistant that works in milliseconds and never gets tired.
That framing produces rules a firm can adopt today. Every workflow has a supervising attorney of record. Anything that leaves the firm is reviewed by a person competent to evaluate it. The audit trail exists so supervision can be demonstrated to a client, a carrier, or a court, not merely asserted. Firms have supervised paralegals, staff attorneys, and contract review teams for decades; the duty is familiar. What is new is the speed and the volume, and the controls above are how the familiar duty scales to both.
Write the playbook before you build the agent
The constraint on agentic deployment is rarely capability. Models can plan and execute multi-step work today, and the tooling matures monthly. The constraint is the firm's ability to say precisely what an agent may do: which matters, which sources, which actions, which stopping points, and which people approve. Firms that write those playbooks first ship agents faster, because the risk committee and the professional responsibility partner are reviewing a document instead of reacting to a demo.
Architecture decides how hard that writing is. Reframe's Agent Workflows run against the permissioned Context Graph described in our platform overview, so an agent's world is scoped to what the requesting user may see before any planning begins, and every step lands in the audit trail with its sources attached. How we design, evaluate, and govern those builds is covered in the harness.
One further variable sets the ceiling on how much autonomy a firm can responsibly grant: where the agent runs. Software with reach across the firm's knowledge belongs inside the firm's own boundary, under its keys and its network controls, for the reasons laid out in our piece on tenant isolation.
Agents will take on more legal work every quarter from here. The firms that benefit will be the ones that made "may" a precise word before they let the software demonstrate "can."