The threat
The draft is the work. The matter is the draft.
Every path below is a fee earner producing something a client is billed for. None of it is exfiltration, which is why a policy banning AI in a professional-services firm tends to produce quiet non-compliance rather than compliance.
-
Summarising a discovery bundle
The bundle is the input, and it arrives as an attachment rather than as typed text.
Trips Privilege
-
Redrafting a clause
The clause is pasted with the deal around it, because the surrounding terms are what make it mean anything.
Trips Client confidential
-
Researching a point of law
The safest question to ask carries the facts that prompted it.
Trips Privilege
-
Drafting an engagement or advice letter
The letter is made clearer by pasting the letter, and it names the client throughout.
Trips GDPR
None of these is caught by a universal detector, and that is the honest position: they are caught by rules an administrator writes. A pattern rule — a matter-number format, a client-code prefix — runs inside the deadline and can block. An entity type described in words runs after the send and reports only.
How the detection layers workWhat’s specific here
What a firm can actually enforce.
The distinction between a rule that blocks and a rule that reports is not a licensing tier. It is a consequence of where each one runs, and it is worth understanding before a policy is written.
-
01
A pattern rule can stop a send
Matter numbers, client codes and document-classification headers are formats. A regular expression over them runs in the agent, inside the 250 ms deadline, so a framework set to block actually blocks.
-
02
An entity type reports, and says so
A rule described in words — “opposing party” — runs on the on-device model after the send has gone. It produces the same finding an analyst cannot tell apart, but it cannot stop anything, and the console says so where the rule is written rather than in a footnote.
-
03
Rules never leave your tenant
Custom rules are scoped per organisation and are never shared across tenants. A client list written into a rule is configuration on your own devices, not training data.
-
04
Nobody reads the document
Administrators see a rule name, a count, a confidence and a masked snippet. The text of a privileged document is never received, which is the part that makes this defensible to a client and to a regulator.
What it does here
Someone pastes a matter note. Itzal stops it.
Prohibition without an alternative produces unmonitored use on personal devices, which is a worse position for a firm than supervised use. Itzal sits on the laptop and checks the text in the instant before it is sent.
The matter number is a format your firm defines, so it is a pattern rule and it can block. Your risk team gets a record saying which rule fired; the text itself never goes anywhere.
Illustration. The data shown is invented.
Rollout
Write the rules before you switch anything on.
Nothing here is caught by a built-in detector, so the pilot measures rules the firm wrote. That inverts the usual order: configuration comes first, and the log-only window tells you whether the rules were any good.
-
00
Write the first rules
Matter-number format, client-code prefix, document classification headers. A pattern rule runs in the agent and can block; an entity type described in words runs after the send and reports only.
-
01
Log-only, one practice group
Nothing is blocked. The question is whether the matter-number pattern fires on matters and not on invoice references, and only real drafting answers it.
-
02
Tune the rules
Most first-pass regexes are too loose. Tightening them is the work, and it is faster than tuning a general-purpose detector because the format is yours.
-
03
Warn
Fee earners are the least tolerant audience in any organisation for a control that interrupts drafting. A high dismissal rate means the rule is wrong, not that the warning is too quiet.
-
04
Block on the pattern rules
Only pattern rules can block, because only they finish inside the deadline. Entity-type rules keep reporting, and the console says which is which.
If every phase runs to its minimum How far it slides if they all run long
Straight answers
Does using this waive privilege?
The question a firm should ask is what the control receives. Itzal detects on the device and sends findings, not text: a data type, a count, a confidence, a masked snippet and a destination. The privileged material is never transmitted to us, which is a materially different posture from a service that inspects content server-side.
Can we write rules for our own matter numbering?
Yes, and this is the normal configuration here rather than an advanced one. A rule has one matcher: a regular expression, which runs in the agent and can block; or an entity type described in words, which runs on the on-device model after the send and reports only.
What about documents we receive from clients as scans?
A scanned page with no text layer needs OCR, and fax-encoded or JPEG 2000 pages are refused rather than guessed at — then reported unscanned rather than recorded as clean. The distinction matters when the record is the evidence.