Your AI Paralegal Needs a Supervision Policy. Here's How to Write One in Rego.

Category: Legal & Professional Services | Reading time: 7 min

---

AI Paralegals Are Here. Governance Isn't.

Law firms are deploying AI paralegals at scale. Document review, contract extraction, due diligence summaries, legal research compilation — tasks that once consumed paralegal hours are now handled by AI in minutes. The productivity gains are real: firms report 60–80% time reduction on document-intensive tasks.

But the governance question is mostly unanswered: under what rules does the AI paralegal operate? What is it allowed to do without supervision? What requires attorney review? What is it prohibited from doing entirely?

Without a supervision policy, you have an AI paralegal that operates on implicit rules — the LLM's training, your system prompt, and whatever guardrails the vendor built in. That's not a supervision policy. That's a hope.

This post walks through building a real AI paralegal supervision policy using Rego — the same policy language the Taos governance kernel evaluates.

---

The Three-Tier Supervision Model

The most practical framework for AI paralegal supervision uses three tiers:

Tier 1: Autonomous — routine tasks within well-defined parameters that the AI executes without attorney review Tier 2: Review Required — tasks that complete AI execution but require attorney review before any output leaves the firm Tier 3: Attorney-Led — tasks where the AI assists but an attorney must be the principal actor

The goal is to maximise Tier 1 for efficiency, correctly route Tier 2 for quality control, and preserve Tier 3 for tasks where professional judgment is irreplaceable.

---

Writing the Policy: Step by Step

Step 1: Define the task taxonomy

Start by categorising the tasks your AI paralegal handles:

package taos.legalops.paralegal_supervision

# Task categories
document_extraction_tasks := {
    "contract_extraction",
    "deposition_summary",
    "document_review_tagging"
}

client_communication_tasks := {
    "draft_client_update",
    "draft_status_report"
}

legal_analysis_tasks := {
    "research_summary",
    "statutory_interpretation",
    "case_law_analysis"
}

filing_tasks := {
    "court_filing",
    "regulatory_submission",
    "agency_correspondence"
}

Step 2: Define Tier 1 (autonomous)

# Tier 1: Autonomous execution
# Routine extraction and review tasks on internal documents
tier_1_autonomous {
    input.task_type == document_extraction_tasks[_]
    input.document_classification == "internal"
    input.matter_value_usd < 50000
    input.involves_client_pii == false
}

action = "allow" { tier_1_autonomous }

Step 3: Define Tier 2 (AI executes, attorney reviews)

# Tier 2: AI executes, attorney review before output leaves firm
tier_2_review_required {
    input.task_type == client_communication_tasks[_]
}

tier_2_review_required {
    input.task_type == legal_analysis_tasks[_]
}

tier_2_review_required {
    input.document_classification == "client_facing"
}

tier_2_review_required {
    input.matter_value_usd >= 50000
}

action = "require_approval"   { tier_2_review_required; not tier_1_autonomous }
required_role = "supervising_attorney" { tier_2_review_required }

Step 4: Define Tier 3 (attorney-led, AI assists only)

# Tier 3: Attorney must be principal — AI in support role only
tier_3_attorney_led {
    input.task_type == filing_tasks[_]
}

tier_3_attorney_led {
    input.involves_privileged_communication == true
}

tier_3_attorney_led {
    input.requires_professional_judgment == true
}

# Deny AI autonomous execution — requires attorney-initiated workflow
action = "deny" {
    tier_3_attorney_led
    input.initiated_by_role != "attorney"
}

---

The Complete Policy File

Assembling the tiers into a working policy:

package taos.legalops.paralegal_supervision

import future.keywords.in

# ── Task taxonomy ─────────────────────────────────────────────────────────────

document_extraction_tasks := {"contract_extraction", "deposition_summary", "document_review_tagging"}
client_communication_tasks := {"draft_client_update", "draft_status_report"}
legal_analysis_tasks       := {"research_summary", "statutory_interpretation", "case_law_analysis"}
filing_tasks               := {"court_filing", "regulatory_submission", "agency_correspondence"}

# ── Tier 3 check (hardest gate — evaluate first) ──────────────────────────────

tier_3_required {
    input.task_type in filing_tasks
}

tier_3_required {
    input.involves_privileged_communication == true
}

# ── Tier 1 check ──────────────────────────────────────────────────────────────

tier_1_eligible {
    input.task_type in document_extraction_tasks
    input.document_classification == "internal"
    input.matter_value_usd < 50000
    not input.involves_client_pii
}

# ── Tier 2 check ──────────────────────────────────────────────────────────────

tier_2_required {
    not tier_1_eligible
    not tier_3_required
}

# ── Final decisions ───────────────────────────────────────────────────────────

allow { tier_1_eligible }

action = "allow"            { tier_1_eligible }
action = "require_approval" { tier_2_required }
action = "deny"             { tier_3_required; input.initiated_by_role != "attorney" }

required_role = "supervising_attorney" { tier_2_required }
rule_fired    = "tier_1_autonomous"    { tier_1_eligible }
rule_fired    = "tier_2_review"        { tier_2_required }
rule_fired    = "tier_3_attorney_led"  { tier_3_required }

---

Deploying the Policy

With this policy in the Taos control plane:

1. AI paralegal receives a task request
2. Kernel evaluates the supervision policy against task attributes
3. allow → AI executes autonomously
4. require_approval → AI executes, output queued for attorney review before delivery
5. deny → task routed to attorney-initiated workflow; AI stands by to assist

The attorney reviewing a Tier 2 task sees the AI's output, the supervision policy rule that triggered review, and the specific attributes that caused escalation. They review, approve or modify, and the output is sent.

---

Updating the Policy as Your Practice Evolves

Six months in, you find that research_summary tasks are consistently high quality and rarely modified by reviewing attorneys. Move it to Tier 1:

# Updated: research summaries below matter value threshold are now autonomous
tier_1_eligible {
    input.task_type == "research_summary"
    input.matter_value_usd < 25000
    input.jurisdiction == "US-federal"
}

Publish the policy update in the control plane. No code change. No deployment. The next task evaluation uses the new rule. The change is versioned, timestamped, and attributed to the person who made it.

---

The Bottom Line

An AI paralegal without a supervision policy is a liability. An AI paralegal with a well-designed Rego policy is a force multiplier that operates within defensible professional boundaries.

Write the policy. Encode the tiers. Deploy it in the kernel. Then watch your paralegals focus on judgment while the AI handles volume.

---

Tags: AI paralegal, legal AI governance, supervision policy, Rego policy, law firm AI, professional responsibility