box-legal-workflows

What this skill does

# Shared Legal Concepts

> **PREREQUISITE:** Read `box:box` for Box MCP authentication, tool selection, and base workflows. If missing, run: `npx skills add https://github.com/box/box-for-ai --skill box`

Common legal principles, risk frameworks, and Box workflow patterns used by legal skills (M&A, Intake, Contract Review).

---

## Risk Rating Framework

**[CONFIRM WITH USER: What risk rating criteria does your firm use?]**

### High Risk
- Matters > firm's value threshold (e.g., $500K+)
- Politically exposed persons (PEP)
- Cross-border with sanctioned jurisdictions
- Conflicts of interest identified
- Missing critical contract protections
- 3+ material variances from standard templates
- Reputational risk to firm
- Criminal matters with media exposure

### Medium Risk
- Complex corporate matters
- Litigation or regulatory exposure
- Unclear source of funds
- Minor conflicts requiring analysis
- 1-2 material variances from templates
- Incomplete documentation (can be supplemented)
- Matter value in mid-range (e.g., $50K-$500K)

### Low Risk
- Individual clients, standard matters
- No litigation history
- All required documents complete and valid
- No conflicts of interest
- No material variances from templates
- Matter value below threshold (e.g., < $50K)

**[CONFIRM: Customize thresholds for your firm's practice areas]**

---

## Human-in-the-Loop Requirements

### ALWAYS Confirm Before:
1. Granting external access (outside your organization)
2. Creating shared links (especially Open/Company-wide)
3. Auto-approving any client or contract
4. Assigning risk ratings
5. Routing to specific attorneys
6. Generating legal documents (engagement letters, contracts)
7. Sharing legal documents with clients/third parties
8. Copying files to externally-accessible folders (if file was NOT already externally accessible)
9. Creating initial folder structures (default vs. custom for deal rooms, matter folders)

### CONFIRM If Uncertain:
10. Writing or modifying metadata (if extracted values are unclear or contradictory)
11. Copying or reorganizing files (if categorization is ambiguous)
12. Making decisions based on AI analysis (if confidence is low or edge case)

### Proceed Autonomously When Confident:
- Writing metadata when extraction is clear and unambiguous
- Copying/organizing files between folders with same access level (internal-only to internal-only, or external to external)
- Extracting standard information (dates, parties, amounts) with high confidence
- Creating summary reports and analysis documents
- Categorizing documents by obvious type

### NEVER Auto-Approve Without Authorization:
- High-risk matters
- External access grants (Editor/Co-Owner roles)
- Engagement letters or contract generation
- Matters in sensitive practice areas (criminal, sanctions)
- Clients/contracts above value thresholds
- Actions that bypass firm policies

---

## Confidentiality & Data Protection

### Access Control Principles
- **Need-to-know**: Grant minimum permissions required
- **Least privilege**: Default to Viewer over Editor
- **Folder-level**: Prefer specific folders over root access
- **Time-limited**: Set expiration dates on external collaborations
- **Audit trail**: Track access grants with `list_item_collaborations`

### Sensitive Information Categories
- Client intake forms (ID scans, financial records)
- Contract terms (pricing, IP rights, liability caps)
- M&A deal documents (financials, strategy, due diligence)
- Attorney work product and strategy memos

**Never expose to:**
- External parties beyond need-to-know
- Internal staff outside matter team
- Open shared links
- AI training (follow Box AI governance)

### Box Collaboration Roles

**[CONFIRM: What permission level is appropriate?]**

| Role | View | Upload | Edit | Delete | Invite | Use Case |
|------|------|--------|------|--------|--------|----------|
| Viewer | ✅ | ❌ | ❌ | ❌ | ❌ | Clients, read-only stakeholders |
| Uploader | ❌ | ✅ | ❌ | ❌ | ❌ | External counsel submissions |
| Previewer | ✅* | ❌ | ❌ | ❌ | ❌ | High-confidentiality (no download) |
| Editor | ✅ | ✅ | ✅ | ✅ | ❌ | Internal team members |
| Co-Owner | ✅ | ✅ | ✅ | ✅ | ✅ | Deal leads, matter owners |

*Preview only, no download

---

## Box AI Governance

### When to Use Box AI
- Document completeness checks
- Risk factor identification (flag for human review)
- Metadata extraction (dates, parties, terms)
- Contract comparison (identify variances)
- Due diligence Q&A (with citation verification)

### When NOT to Use Box AI
- Final legal advice/decisions (human attorney only)
- Access control decisions (human approves permissions)
- Client conflict checks (use firm's conflict system)
- Privilege determinations (attorney judgment)
- Settlement negotiations or strategy

### Best Practices
- **Pace calls**: 1-2 seconds apart (rate limits)
- **Verify citations**: Surface source documents
- **Provide context**: "Assessing risk for law firm. Identify..."
- **Limit scope**: Search specific folders, not entire account
- **Human verification**: AI informs, human decides

---

## Common Legal Workflows

### Document Review Pattern
1. Authenticate (`who_am_i`)
2. Locate folder (`list_folder_content_by_folder_id` or `search_folders_by_name`)
3. Inventory documents (`list_folder_content_by_folder_id`)
4. **[CONFIRM: What documents are required?]**
5. Assess completeness (`ai_qa_multi_file`)
6. Extract metadata (`ai_extract_structured_from_metadata_template`)
7. Write metadata (`set_file_metadata`)
8. Route for review (`create_file_comment` + `create_collaboration`)

### Permission Audit Pattern
1. **[CONFIRM: What folder to audit?]**
2. List current permissions (`list_item_collaborations`)
3. Categorize: internal vs. external, roles, expirations
4. Present audit report
5. **[CONFIRM: Should permissions be modified?]**
6. Make approved changes
7. Re-audit to verify (`list_item_collaborations`)

### Temporal Monitoring Pattern
1. **[CONFIRM: Date range? (e.g., next 60 days)]**
2. Search by metadata date field (`search_files_metadata`)
3. Identify owner, calculate days to deadline
4. **[CONFIRM: Who to notify?]**
5. Create reminder (`create_file_comment`)
6. Update metadata (`set_file_metadata` with notification tracking)

---

## Metadata Strategy

**[CONFIRM: Do you have existing Box metadata templates?]**

### Common Legal Metadata Fields

**Matter information:**
- matter_id, matter_name, practice_area, matter_owner

**Parties:**
- client_name, counterparty_name, contracting_entities

**Dates:**
- execution_date, effective_date, expiration_date, review_date

**Status:**
- active, expired, under_negotiation, pending_approval

**Risk:**
- risk_rating (high/medium/low), risk_factors, review_required

**Contract terms:**
- contract_value, payment_terms, notice_period, auto_renewal

**Review tracking:**
- reviewed_by, review_date, next_review_date

### Template Setup (If None Exists)
1. **[CONFIRM: Create metadata template?]**
2. Define fields based on firm needs
3. Use `create_metadata_template`
4. Apply to files with `set_file_metadata`

---

## Decision Transparency

For every automated decision, document:
- **WHAT**: Approved, rejected, routed, risk rating
- **WHY**: Supporting evidence, risk factors, variances
- **WHEN**: Timestamp
- **WHO**: Human or "Automated Review Agent"
- **SOURCES**: Which documents, sections, pages
- **TRACEABILITY**: Write summary to Box, add to metadata

---

## Compliance & Audit Trail

### Maintain Records Of:
- Permission grants (who, what, when, why, expiration)
- Risk assessments (criteria, factors identified)
- Routing decisions (who assigned, why)
- Client approvals/rejections (basis)
- Contract reviews (variances, ratings)

### Verification Steps:
1. `list_item_collaborations` before and after permission changes
2. Record returned IDs (folder, file, collaboration IDs)
3. Timestamp all actions
4. Write decision summaries to Box
5. Update metadata to reflect current state

---

## Legal Tool Selection

| Legal Ta