Human review gates

This lesson is educational and is not legal advice. Actual approval requirements depend on professional duties, matter risk, organizational policy, jurisdiction, and forum.

A gate is a point where an authorized person evaluates evidence and decides whether work can proceed. Legal workflows often need more than one gate because errors can enter during intake, retrieval, analysis, drafting, and distribution.

A practical sequence is:

1. Use-case gate: Is AI appropriate for this task and consequence?
2. Data gate: Is the system approved for the information and purpose?
3. Source gate: Are the documents complete, authentic, current, and correctly scoped?
4. Analysis gate: Are findings supported, limitations visible, and contrary points considered?
5. Position gate: Does an authorized legal or business owner approve the proposed interpretation or negotiating position?
6. Final-artifact gate: Does the assembled document preserve verified facts, citations, language, and formatting?
7. Action gate: Is the person authorized to send, sign, file, disclose, or otherwise act?

Not every low-stakes task needs seven separate meetings. Gates can be combined when risk is low and responsibilities are clear. They should not disappear merely because the tool is fast.

Assess at least four dimensions:

• Consequence: harm if the output is wrong or disclosed.
• Uncertainty: missing facts, unsettled law, conflicting authority, or ambiguous language.
• Detectability: whether a reviewer can readily notice an error.
• Authority: whether the output commits, represents, or affects another person.

High consequence and low detectability are especially dangerous. A fabricated citation may look convincing; a changed exception in a clause may be hard to spot; a privilege decision may affect later proceedings. These uses require source-level inspection and qualified approval. Some should not use AI at all.

Define risk tiers with specific controls. For example, a low-risk formatting aid may require ordinary proofreading. A medium-risk playbook comparison may require clause-by-clause verification by a trained reviewer. A filing, legal conclusion, settlement position, or sensitive investigation may require counsel review, independent citation checks, and documented final approval.

“Review the output” is not actionable. Give the reviewer:

• the original request and permitted scope;
• all source documents and their versions;
• the model output and any retrieved material;
• a claim-to-source or clause-to-playbook mapping;
• known limitations and open items;
• a checklist tailored to the task;
• authority and escalation rules;
• a way to reject, correct, and record the decision.

The reviewer should compare against sources, not merely read the answer. For a summary, verify every material fact and qualification. For research, retrieve every authority. For a contract, inspect definitions, cross-references, exclusions, and redlines. For a draft communication, confirm recipients, confidentiality, claims, commitments, and attachments.

Review time must be realistic. If automation increases document volume tenfold while staffing stays fixed, the gate may become ceremonial. Measure the number and complexity of outputs, not only average review minutes.

People tend to anchor on a confident first answer. Reduce this by showing primary evidence beside the proposed finding, requiring reviewers to state their own decision, and sometimes asking them to inspect the source before seeing the model’s recommendation.

Do not display a risk score without its rule and evidence. Avoid default “approve” buttons. Highlight uncertainty and missing inputs at least as strongly as conclusions. Sample approved outputs for deeper quality review, because reviewers can share the same blind spots.

For high-impact work, separate roles. One person may prepare the AI-assisted analysis, another verify citations or redlines, and an authorized lawyer approve the legal position. Separation does not guarantee quality, but it reduces single-person and single-model failure.

The workflow should stop when:

• a required source or attachment is missing;
• jurisdiction, version, or effective date is unclear;
• a citation or quotation cannot be verified;
• confidential data entered an unapproved system;
• output exceeds the reviewer’s expertise or authority;
• the model changes a prohibited term or invents a fact;
• conflicting authority or policy cannot be resolved;
• the final action would exceed approved limits.

Escalation must name a role and expected artifact. “Ask legal” is weaker than “send the source clause, playbook deviation record, and unresolved definition to commercial counsel before negotiation continues.”

Record the decision, reviewer, time, evidence, exceptions, and resulting action. Logs help reconstruct what happened, but they should not duplicate protected content unnecessarily.

Track severe errors separately from overall accuracy: nonexistent citations, missed prohibitions, privacy exposures, altered numbers, omitted exceptions, or unauthorized sends. Also track reviewer disagreement, correction rates, escalations, time, and issues discovered after approval.

A falling review time is not automatically success. It may reflect a better workflow, or it may show rubber-stamping. Test with seeded edge cases and periodically ask reviewers to explain why an item passed. If they cannot connect approval to evidence and policy, strengthen the gate.