AI Legal LAB · Side Event · Legal Revolution · 21 September 2026 · 09:30–11:30

Anatomy of a Legal Agent

What an Agent is actually made of — and where you can direct, limit and control it.

Open this page

01

Model and Harness

The language model is interchangeable. What defines the Agent is the environment around it — known in technical terms as the Harness.

Harness

Instructions

CLAUDE.md · Skills

Tools

files · MCP · execution

State

working directory · history

Language model

makes no decisions on its own

Permissions

what is allowed

Hooks

assessment at every step

Approval

a human decides

Request
Context
Action
Review
Response
The model is interchangeable — it becomes controllable only through the layer around it.
Model
Prediction of the next token. Probabilistic, not rule-based.
Context
Everything present in the context window at runtime. What is not there does not exist for the Agent.
Tools
Defined interfaces the model may invoke — to read, write and execute.
Boundaries
The only part that does not depend on the model.Everything above is interpretation. Only here does a rule become mandatory.

It is called Claude Code because the environment comes from software development. What you write in it is still prose.

02

The CLAUDE.md

A file in the working directory that is loaded into the context in full at every start. It defines who the Agent is and what it does not do.

CLAUDE.md

# Legal Department — Working Instructions

## Role
Legal department associate.
Responds in English and uses a formal register externally.

## Boundaries
- Creates drafts only.
- Never sends anything itself.
- Never sets the status to “completed”.
- If the basis is unclear: ask a follow-up question;
  do not make assumptions.

## Filing
Matters:    matters/
Templates:  templates/

~/.claude/

principles for all projects

→

legal-department/

rules for this department

→

legal-department/matters/

specifics of an individual matter

Scope
Applies to every session in this directory — without anyone having to invoke it.
Role
Defines perspective, language and register.
Boundaries
Prohibitions in prose. The model reads them and generally follows them.A default rule, subject to discretion — see section 04.
Hierarchy
Multiple files overlap; the more specific one prevails.

Lex specialis derogat legi generali — the principle is familiar to you. Here, it is the loading order.

03

The SKILL.md

A working instruction with two parts: a header that defines its scope and a body that specifies the steps.

SKILL.md

---
name: ticket-intake
description: Use this Skill when a new ticket
  has the status “received” and the initial
  review must be carried out.
---

# Initial review

1. Load the ticket and review attachments.
2. If the contractual basis is missing:
   ask a follow-up question and stop.
3. Set category and contract type —
   field values: see references/board-fields.md
4. Record a deadline — only if it is legally or
   contractually binding. Requested dates are not
   binding deadlines. Review the contract for term
   and termination clauses.
5. Set the status to “open”.
description
The scope. For every request, the model checks whether the facts fall within it — and loads the Skill only then.In effect, this is legal subsumption. If the constituent elements are imprecise, the rule applies too rarely or too often.
Body
The prescribed steps. Prose, numbered and written in the organisation's language.
references/
Externalised details loaded only when needed — keeping the context lean.Incorporation by reference rather than full quotation.

The most common error is not an incorrect body, but an imprecise description: the Skill is then never activated in the first place.

04

Three levels of control

They are routinely confused. The distinction determines whether a requirement is merely a statement of intent or an effective control.

Instruction

CLAUDE.md · SKILL.md

The model reads the requirement and weighs it against the task.

Probabilistic. Default rule, subject to discretion.

Permission

settings.json · allow / deny

The tool is not available at all. No discretion is required.

Deterministic, static.

Hook

PreToolUse · exit 2

A program checks the specific invocation and stops it.

Deterministic, situational. Mandatory.

If compliance is addressed at the first level, it has merely been requested. Only at the third level has it been enforced.

05

How a Hook decides

Event, scope, assessment, legal consequence. The structure is familiar — except that here it runs before every individual tool invocation.

Event

PreToolUse

→

Scope

matcher

→

Assessment

script, no model involved

  • ↳ exit 0 — invocation proceeds
  • ↳ exit 2 — invocation is stopped
Outbound block
No transmission to external recipients, under any circumstances.
Independent reviewer
No status change without a completed review.

The Hook does not ask the model for permission. It runs before the model can do anything at all.

06

Separation of drafting and review

A second Agent with its own context, its own mandate and its own tools — one that did not write the draft.

Drafter

creates the draft

→

Reviewer

separate context, does not know how the draft was produced

→

Human

decides

  • ↳ Objection — returned for revision

The same context that produced an error will not reliably detect it afterwards.

07

Development is not an end state

No Agent covers every case. Use reveals situations that were not anticipated — and that are then addressed separately through Skills and organisational knowledge.

Unanticipated case

Skill does not apply

→

Identify the gap

What was missing?

→

Resolve the case

manually or with guidance

Derive a rule

→

three lines in SKILL.md

→

next equivalent case

→

correct automatically

Unanticipated case
A situation that was not considered during initial planning.
Knowledge feedback
Turning a resolved exceptional situation into readable, reusable rules.

An Agent is never finished. It develops with the cases recorded in Skills and knowledge.

08

The case from the lab

The seven sections above explain the building blocks. Here they are applied to the case we worked through in the lab — a real working environment, not an example from a brochure.

8.1

The company

Brandtmann & Co. KG, Osnabrück

A third-generation family business selling outdoor equipment, with around 400 employees.

The legal department consists of two people: its head and a legal counsel. All requests from the business units come through the ticket board.

The Agent supports them as a legal associate — it prepares matters so that a human can decide them quickly.

8.2

The request

Nina Kerkhoff

Marketing · 19 August 2026, 08:42 · Channel: Ticket board

Cooperation agreement with SV Osnabrück-Nord — please review

We have negotiated a shirt sponsorship agreement with SV Osnabrück-Nord for the coming season. The club has sent us its standard contract.

Term of one season, 1 September 2026 to 30 June 2027 · EUR 12,000 in two instalments · logo on the front of the shirts, perimeter advertising, mention on the club website · 20 complimentary tickets per home match

We need this by Friday, as that is when they want to sign. The club is printing the shirts next week; after that, no changes will be possible.

Does this look all right? From our perspective, it is a standard matter.

8.3

The mistake every Agent makes at first

without the rule

First run

The Agent enters Friday as the Deadline. Nina wrote it that way, so it appears in the file. Legally incorrect: a requested date from a business unit is not a binding deadline.

with the rule

Second run

Deadline remains empty; Friday is recorded as the Requested date. The actual binding deadline is elsewhere — in the contract's termination clause, which the request does not mention at all.

8.4

What made the difference — three lines

.claude/skills/ticket-intake/SKILL.md

## 4 · Recording deadlines

A deadline is recorded only if it is legally or
contractually binding — a statutory or court deadline,
a termination or objection deadline, or a deadline
arising from the contract itself.

A requested date from a business unit is not a binding
deadline. Record it as Requested date; Deadline remains empty.

Review the contract specifically for term, renewal
and termination clauses.

This is the knowledge feedback from section 07 — not as a model, but as the three paragraphs that made the second run correct.

8.5

Where the boundary actually takes effect

“Send the draft to Nina.”

STOPPED — Outbound block

This invocation would have sent a message externally.

Nothing leaves this working environment for a third party.
Drafts are filed, then approved and sent by a human.

The Hook is attached to the Bash tool as PreToolUse and checks the specific command for transmission patterns — mail, sendmail, curl targeting an email API, or smtplib. If one matches, it exits with exit 2 and the invocation does not proceed. No language model is involved.

The CLAUDE.md says that nothing may be sent externally. The Hook enforces it.

8.6

The second safeguard

A second Hook on Write and Edit stops any memorandum for which no review record exists in the same matter. The reviewer is a separate Subagent with its own context and read-only tools — it did not write the draft and does not know how the draft was produced. See section 06.

Material to take away

The demo environment

The fictional legal department from the lab — CLAUDE.md, two Skills, two Hooks and the reviewer, plus the matter to try out yourself. Claude Code required.

Open this page

Articles, webinars and offers

Subscribe to the blog