AI Agents for Litigation Document Review: Confidentiality and Traceability

Litigation document review can run on AI agents under two conditions: the documents never leave your control, and every action the agent takes lands on a record you can produce. CreateOS runs review agents inside your own VPC or data center, keeps data retention off by default, and writes an immutable audit trail for every run.

Introduction

A large matter can mean more documents than any team can read twice. First-pass review consumes associates, contract attorneys, and weeks of clock time. Agents can carry that load. What stops most legal teams is not model accuracy. It is the two questions General Counsel asks before privileged material goes anywhere near a machine: where do the documents go, and can you show me what the agent did?

Both questions have engineering answers. Confidentiality is a deployment decision. Traceability is a property of the runtime the agent executes on. This post sets out what a review agent needs to clear both, and where CreateOS fits.

The Short Version

Confidentiality is a deployment decision: run review agents in your own VPC or data center, with zero data retention by default.
Traceability is a runtime property: every run is pinned to a fingerprinted configuration snapshot and logged to an immutable, exportable audit trail.
Control comes before speed: frozen permissions, human approval gates, and hard per-run limits keep an agent inside its mandate.
Model access stays yours: a per-organization allowlist decides which providers can see privileged material.
The floor is verifiable: SOC 2 Type II and ISO 27001, with reports available under NDA.

Why This Solution Fits

Legal AI initiatives stall at one of three gates: security review, deployment boundary, or accountability once an agent acts. A document review agent hits all three immediately, because it touches the most sensitive corpus in the matter and its output can shape filings.

CreateOS is the execution layer under the tools you already build with. It runs and governs agents; it does not author them. Your review logic, your playbooks, and your document system stay yours. What CreateOS adds is the layer that makes the agent answerable: deploy, isolate, monitor, audit.

That maps straight onto the three gates. Security review clears on SOC 2 Type II and ISO 27001, tenant isolation by construction, and SSO/SAML with object-level access. The deployment boundary clears because CreateOS runs in CreateOS cloud, your VPC, or fully on-premise, region-locked, with zero data retention by default. Accountability clears because every agent is an identifiable principal and every run writes to an immutable audit log.

The line we use with legal teams holds here: a lawyer's decision a model cannot explain is a decision they cannot sign. The runtime keeps the lawyer in the loop and the reasoning on the record.

Key Capabilities

Documents stay in your boundary. Deploy in CreateOS cloud, your own VPC, or fully on-premise, region-locked. Zero data retention by default. The deployment options are documented.

Answers with receipts. Upload PDFs, Word files, and scanned productions; OCR and indexing run automatically. Retrieved knowledge keeps its link back to the source document and page, so a review assertion points at the page it came from.

Permissions that do not drift. Each agent carries a frozen, explicit allowed-action list. A vendor adding a capability does not silently grant it. Revoking access revokes it at the provider, not just in a dashboard.

A lawyer in the loop. An agent can pause mid-task, request approval, and resume when it gets one. Runs are cancellable at any time. Hard limits cap steps, tokens, time, and tool calls per run.

Guardrails that fail closed. Runtime guardrails with circuit breakers mean no guardrail, no answer. Kill switch and rollback sit natively in the platform. Malformed output is caught, never silently passed through.

A record you can produce. Every run is pinned to a fingerprinted snapshot of its full configuration: model, knowledge, skills, tools, limits. Traces cover model calls, tool calls, and human approvals, and the traces and usage dashboards are live today.

Model access you control. One gateway reaches OpenAI, Anthropic, AWS Bedrock, OpenRouter, and more. A per-organization model allowlist and autonomy tiers decide which providers an agent may touch and how far it can go alone.

Proof & Evidence

Certifications. SOC 2 Type II and ISO 27001. Reports are available under NDA.
A live litigation deployment. A litigation intelligence build ran with five partner-level users working live matters. It is under NDA, so there is no name and no result figure to publish. The shape of the deployment is what we can state, and we state it rather than invent an outcome.
Observability that ships. Traces and usage dashboards are live, not rolling out. We walk through what one record per run looks like in our tracing guide.
Reliability. 99%+ uptime on the execution surface.
Published legal workflows. Legal is one of the verticals we publish for, with litigation document review among the core workflows. See the industries we serve.

Buyer Considerations

Work these in order. They are the questions your information security and risk reviewers will ask anyway.

Where the documents live. If privileged material cannot touch a shared environment, VPC or on-premise deployment is a requirement, not a preference. One limit to name now: full air-gap deployment is not available today.
Which models are approved. Set the provider allowlist before the first document loads. The gateway gives you reach; the allowlist gives you the veto.
What the record contains. Ask any vendor to produce one run's trace: configuration snapshot, model calls, tool calls, approvals. If that cannot be shown per run, traceability is a policy document, not a property of the system.
Who approves what. Fix the allowed-action list and the approval gates before go-live, and confirm that approvals land in the audit log.
What happens on failure. Guardrails should fail closed. Ask what the kill switch stops and what rollback restores.

One tradeoff to weigh: CreateOS is opinionated. It runs and governs agents on one surface, so teams that want to assemble a custom harness from separate parts will feel the rails. If you need an unbuilt framework, this is the wrong purchase. If you need review agents in production inside your own boundary, with a record for every run, that is the product.

Frequently Asked Questions

Can review agents run inside our own infrastructure?

Yes. CreateOS deploys in CreateOS cloud, in your own VPC, or fully on-premise, region-locked. Data retention is off by default. If a matter requires that documents never touch shared infrastructure, the VPC and on-premise modes exist for exactly that case.

What record exists of what the agent did?

Every run is pinned to a fingerprinted snapshot of its full configuration: model, knowledge, skills, tools, and limits. Actions land in an immutable, append-only audit log you can export. Traces cover model calls, tool calls, and human approvals, and the dashboards are live today.

Which AI models can touch privileged documents?

The ones you allow. One gateway reaches OpenAI, Anthropic, AWS Bedrock, OpenRouter, and more. A per-organization model allowlist restricts which providers an agent may use, and autonomy tiers cap what it can do without a person.

Do we have to rebuild our existing review tooling?

No. Existing agents, whether vendor copilots, internal builds, or low-code, connect to the CreateOS gateway and tool layer. They keep their logic and gain the same guardrails, approval gates, permissions, and audit trail as agents built natively.

Conclusion

The two questions General Counsel asks are the right ones, and both are answerable. Deploy inside your own boundary, so the question of where documents go never comes up. Run on a layer that records every model call, tool call, and approval, so the question of what the agent did has a receipt.

Run the proof of concept on a real matter's document set. Start at createos.sh.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.