Privilege as code, and the log that survives a sanctions motion (step 2/8) · legal studio

The routing table

Run it. Same strategy memo, two different tools, two different answers — that's the entire argument for writing this as code.

Walk the pieces:

TOOLS is the vetting checklist, frozen. Three questions per tool, straight from Opinion 512's Rule 1.6 analysis: is it cleared for client work, does the vendor train on inputs, and who cleared it, when. consumer-chatbot fails everything — it's in the table anyway, because a router that doesn't know about a tool can't block it. vendor-summarizer is the subtle one: cleared for confidential client work, but it trains on inputs. firm-assist is the full stack — cleared, no-training, with a named clearance. The cleared_by field isn't decoration; when a tool's terms change, you need to know whose review is now stale.
The privileged rule is the strictest and runs first. Privileged material — attorney-client communications, work product — moves only through a tool that is both cleared and no-training. That's the distinction the early-2026 privilege decisions turned on: in Heppner, disclosure to a third-party AI platform destroyed work-product confidentiality, while enterprise tools with confidentiality and no-training commitments get analyzed differently. Your router encodes the difference the courts are drawing.
Even the ALLOW is not a shrug. Privileged content through the cleared tool returns "ALLOW — log it; flag for Rule 502(d) coverage check." The disclosure still happened; the mitigation commentators recommend — a 502(d) order where available, ESI-agreement coverage — still needs a human to confirm it's in place. The router's job is to make sure that flag gets raised every time, not just when someone remembers.
The third request is the one that saves careers. "Strategy memo tightened via vendor-summarizer" feels safe — the tool is cleared, it's on the approved list, people use it all day for contract work. Blocked. Cleared-for-confidential and cleared-for-privileged are different clearances, and the training flag is why. This is precisely the distinction a tired human runs past at 11pm and a lookup table never does.

Notice what stayed human. Counsel classified the tools; counsel decided the two booleans on each request are worth deciding carefully; a lawyer still judges whether a given memo is actually work product. The router automates none of that judgment — it automates the consistency, which is the part humans are worst at under deadline.

The routing table

Run it. Same strategy memo, two different tools, two different answers — that's the entire argument for writing this as code.

Walk the pieces:

TOOLS is the vetting checklist, frozen. Three questions per tool, straight from Opinion 512's Rule 1.6 analysis: is it cleared for client work, does the vendor train on inputs, and who cleared it, when. consumer-chatbot fails everything — it's in the table anyway, because a router that doesn't know about a tool can't block it. vendor-summarizer is the subtle one: cleared for confidential client work, but it trains on inputs. firm-assist is the full stack — cleared, no-training, with a named clearance. The cleared_by field isn't decoration; when a tool's terms change, you need to know whose review is now stale.
The privileged rule is the strictest and runs first. Privileged material — attorney-client communications, work product — moves only through a tool that is both cleared and no-training. That's the distinction the early-2026 privilege decisions turned on: in Heppner, disclosure to a third-party AI platform destroyed work-product confidentiality, while enterprise tools with confidentiality and no-training commitments get analyzed differently. Your router encodes the difference the courts are drawing.
Even the ALLOW is not a shrug. Privileged content through the cleared tool returns "ALLOW — log it; flag for Rule 502(d) coverage check." The disclosure still happened; the mitigation commentators recommend — a 502(d) order where available, ESI-agreement coverage — still needs a human to confirm it's in place. The router's job is to make sure that flag gets raised every time, not just when someone remembers.
The third request is the one that saves careers. "Strategy memo tightened via vendor-summarizer" feels safe — the tool is cleared, it's on the approved list, people use it all day for contract work. Blocked. Cleared-for-confidential and cleared-for-privileged are different clearances, and the training flag is why. This is precisely the distinction a tired human runs past at 11pm and a lookup table never does.

Privilege as code, and the log that survives a sanctions motion — step 2 of 8

The routing table

The routing table