What is an AI Control Pack?

AI Control Pack is the enterprise-facing name for an OAP Policy Pack. Each pack defines rules for a capability, such as finance.payment.refund.v1, including limits, assurance requirements, and context validation.

How do I add a policy pack to my endpoint?

Install the Express or FastAPI middleware, configure it with your policy pack ID, and wrap your sensitive routes. The middleware calls the verify API before each request.

Can I customize policy pack limits?

Yes. Organizations can customize limits (e.g., max refund amount, export row count) per policy pack. Limits are enforced at verification time.

Back to Policy Packs

Legal Contract Review Policy

Pre-action governance for legal contract review, drafting, and redlining operations. Enforces firm-specific guardrails, privilege protection, attorney supervision requirements, and jurisdiction controls to prevent malpractice risk and ensure ABA ethics compliance.

v1.0.0

Requirements

Required Capabilities

legal.contract.review

Minimum Assurance Level

Required Limits

allowed_document_types

max_document_size_mb

allowed_contract_jurisdictions

require_attorney_review

privilege_protection_enabled

max_contracts_per_day

allowed_client_tiers

supported_currencies

currency_limits

require_client_consent

require_conflicts_check

require_fee_disclosure

allowed_attorney_jurisdictions

require_matter_isolation

Enforcement Rules

These rules are automatically enforced when using this policy pack

document_type_allowed

document_size_limit

jurisdiction_authorized

attorney_review_required

privilege_protection_enforced

daily_contract_limit

client_tier_authorized

assurance_tier_enforced

idempotency_required

currency_supported

per_currency_value_limit

daily_currency_cap

client_consent_required

conflicts_check_required

fee_disclosure_required

engagement_letter_required

attorney_jurisdiction_authorized

matter_isolation_required

data_encryption_required

supervisor_approval_required

Best Practices

Cache /verify with ETag; 60s TTL
Subscribe to status webhooks for instant suspend
Log all contract review attempts for Verifiable Attestation
Maintain immutable audit trails for malpractice protection
Enforce attorney supervision per ABA Formal Opinion 512
Protect attorney-client privilege in all operations
Implement document type allowlists for firm-specific guardrails
Monitor contract review patterns for unusual activity
Use idempotency keys to prevent duplicate operations
Track jurisdiction compliance for multi-jurisdictional practice
Maintain privilege level metadata for all documents
Require attorney review for high-value contracts based on currency-specific thresholds
Obtain client consent for AI use per ABA ethics rules
Perform conflicts of interest checks per ABA Rule 1.7
Disclose fee reductions from AI use per ABA ethics rules
Require engagement letters for new client matters
Verify attorney licensing in contract jurisdiction to prevent UPL violations
Enforce matter isolation to prevent conflicts with opposing parties
Encrypt client data per ABA Rule 1.6 confidentiality requirements
Require supervisor approval for non-lawyer work per ABA Rule 5.3
Configure per-currency contract value limits for multi-currency operations
Set document retention policies (typically 7-10 years) for compliance