# How to get an AI agent approved by legal

**Bring three things: what the agent may commit to, where its claims come
from, and the record of what it has already said.** Reviews stall because the
answer to all three is currently "we would have to look", and a reviewer
cannot sign off on a look.

The instinct is to bring a model card, an accuracy figure and a wording
filter. None of those answers the question a reviewer is actually asking,
which is: *when this goes wrong, what will we be able to show?*

## The five questions, and what to have ready

**1. What may it commit us to?**
A list, not a paragraph. Eight separate settings — whether it may state a
deadline, make an absolute claim, say our side has approved something, imply
something it did not say, and so on — each either on or off, with the reason
written where a non-engineer can read it. **A limit nobody can explain gets
switched off.**

**2. Where do its facts come from?**
One source with an owner and a date against every line, rather than *the
knowledge base*. The useful sentence for a reviewer is: a claim nobody owns is
a claim the agent may not repeat, and that is enforced rather than encouraged.

**3. What happens when it does not know?**
It escalates and tells the customer it is checking. Not silence, and not a
confident answer — those are the two failure modes, and neither is available
as a configuration option.

**4. What will we be able to show afterwards?**
The record: what was said, which agent, what it relied on, the state of each
of those claims at the time, the authority it was acting under, and whether
anybody has closed it. Append-only, so it is evidence rather than a log
somebody could have tidied.

**5. Who is accountable for the data the limits read?**
This is the question that surprises people, and it is the one a good reviewer
asks last. A limit whose underlying data nobody owns is decorative: the agent
behaves perfectly against wrong information. So every source names its owner
and its review interval, and past that interval the permissions resting on it
switch off by themselves.

## Two things to raise before the reviewer does

**It records; it does not block, today.** Say so first. Every answer carries
`observation_only: true`, and it travels in the answer rather than in
documentation, so a caller honouring it keeps working unchanged the day that
changes. A reviewer who discovers this themselves will discount everything
else you said.

**It never conceals anything.** The point is framing and volunteering, never
concealing. Asked directly, the agent answers truthfully — an agent that hides
a real gap when a customer asks about it is committing exactly the inference
problem the framework exists to prevent. That line does not move, and it is
usually the sentence that ends this part of the conversation.

## What to send them

</agent-promise-register.md> for the source-of-truth question, and
</privacy.md> for what is held and where. The privacy notice names, in one
table, the six things about it that are **not** settled — which in our
experience is the page that buys the most credibility, because every other
vendor's reads as finished.