The Frontier: Attestation, Knowledge Graphs and the Infrastructure Under Legal AI

The frontier of legal AI is no longer the model. For three years the interesting question was capability: could it read the contract, find the clause, draft the memo. That question is largely settled. What is not settled is everything around the model: what it was permitted to touch, whether the same input produces the same answer next quarter, and whether the record can be verified by somebody who does not trust you and cannot re-run it. Those are engineering problems with their own disciplines now. This is an honest account of four of them, plus one problem nobody in the space has solved.

Four disciplines, none of them modelling

• Harness engineering. What sits between the model and everything it can touch, and what that layer is permitted to allow.
• Loop engineering. What happens next, how many times, and when it stops.
• Context engineering. What enters the window, at which point, and what it displaces.
• Knowledge engineering. Making the rulebook machine-readable so an agent cites an obligation rather than paraphrasing it.

Provenance is not a fifth discipline; it is the property the other four exist to produce.

The harness, and the artefact at the end

The harness is where every question a regulator will ask gets answered, or does not. The property that matters most is offline verification: a completed run produces an artefact a third party checks in a fixed sequence of deterministic steps, with no network access and no need to re-run the workflow. An auditor with the bundle and the verifier checks the work on a laptop with the wifi off.

That bar constrains everything upstream: you cannot emit a verifiable bundle from a system that decided things it did not record. So an agent's capability set is granted explicitly at the start of a session and cannot widen during it, a matrix the runtime enforces rather than a convention in a prompt. A prompt injection cannot acquire a tool the session did not start with, the capability boundary the prompting guide treats as the real defence against untrusted material. The signed bundle then carries the inputs and their hashes, the capability set granted, every dispatch and handoff, the constraints evaluated, and every approval with the identity that gave it. Weights and prompts are not the proof; what the run did is.

Loops, context and retrieval

An agent is a loop: gather context, act, check the result, decide whether to go again. Almost every production failure is a failure of that last clause. A controller dispatching against a defined workflow produces the same sequence every time, with the model reasoning inside each step rather than about the order. Decomposition lets each part hold only what it needs, so an orchestrator that never reads a counterparty document cannot be steered by one: isolation, not quality, is the underrated benefit. An uncapped critic loop is a cost you find in billing.

Context is a budget, not a container: a model attending to forty documents attends to each of them less. Procedures, lessons and trajectory live in a store outside the window, retrieved when relevant, the mechanism behind skills. Retrieval is where accuracy lives: when an agent gets a document wrong, it usually answered correctly about the wrong passage, and the fixes are cheaper than touching the model.

Compliance is a graph problem

An obligation is not a paragraph. It is a relationship between an actor, an activity, a condition and a piece of evidence, and it connects to other obligations that qualify it. Store it as text and you can search it; store it as a graph and you can ask whether a run satisfied it. So a run emits a graph rather than a log, in PROV-O, the W3C vocabulary an auditor's tooling reads without us shipping a viewer. The checking is done with SHACL shapes: a violated shape is a rejection recorded at the point the constraint was breached, not a warning written later.

Everything an agent produces is a claim, and claims are kept in separate graphs by how they came to exist: asserted (what the firm states), proposed (what an agent concluded and nobody has accepted), inferred (what follows under the ontology's rules) and trajectory (what a run did). The separation lets an agent be useful and unprivileged at once: it writes freely into proposed, and nothing becomes a fact until a person promotes it. Control mapping becomes a property of the run, so drift is detectable rather than reconstructed from logs by hand.

Provenance is a chain, not a field

Provenance is not an attribution line at the bottom of a report. It is an unbroken chain from a figure in a deliverable back to the source it came from, with everything done to it in between. The chain almost always breaks at the model boundary, because nothing forces it not to. The fix is mostly about output shape: extraction returns structured fields with source identifiers, computation is referenced rather than reproduced, and a run that cannot cite halts. A citation can be wrong; provenance is checkable, because the identifier resolves, the hash matches, and the passage says what the claim says. The intact chain also buys selective retraction: when a source turns out to have been wrong, which of your deliverables depended on it is a query, not an estimate.

Proactive systems, and the honest caveats

A reactive system answers a question. A proactive one holds a standing question and says when the answer changes: a new filing on a matter, a renewal inside its cancel-by window, a rule that touches a policy you hold. Nobody lets a system act unprompted unless four things are true at once, which is why they arrive as one architecture, not four features: the harness bounds what it can touch, the loop bounds when it stops, context bounds what it knows, and the graph records what it concluded. Remove any one and the rest are not enough.

Underneath sits the central tension. Attestation rests on reproducibility, and adaptation deliberately breaks it: a system that learns from corrections has a different configuration on Tuesday than in March. You can make the change auditable by versioning every adapter, hashing every base, and treating a retrain as a change to a control with a reviewer attached. What that does not answer is whether a firm can be accountable for a system whose behaviour changes without a human deciding it should. Everyone has that gap; anybody claiming otherwise is selling a roadmap.

This is why the delivery model is a technical choice: an attestation system encodes a firm's interpretation of its own obligations, none of it written down where an outsider could read it, so you get it by sitting in the room while the work happens. When you read any frontier claim, including ours, a good answer names a file, a hash or a mechanism, not an intention.

This is the infrastructure beneath the skills, connections and plugins earlier in the series, and the whole argument is set out in the AI guide for legal practice.

Ready to go further? Download the five-part legal series, or send us a workflow and we will tell you whether it is worth building.