New-matter intake agent with scoped tools and approval gates

The problem

Agents that can take actions are where AI prototypes most often go wrong in practice. The model is given the ability to write to a system and asked politely to be careful. This prototype does the opposite. The agent gets the smallest set of tools that can do the job, every action is logged, and the one action with consequences, opening a matter, is unavailable until a person with the right role approves.

Constraints

• A made-up client and adverse-party database of about 500 names, seeded with near duplicates such as “ACME Logistics LLC” and “Acme Logistic Inc.” so that fuzzy matching is tested instead of assumed.
• The search tools are read only. The draft tool writes only to a staging table.
• open_matter can be called only after an approval record exists for that draft, and the check lives in the API, where the model cannot reach it.
• Sign-in through an enterprise identity provider with two roles: requester and approver.

Planned design

1. Intake accepts a pasted email. The agent extracts the parties, the matter type and the requested timeline.
2. Tools: search_clients and search_adverse_parties (read only, fuzzy), draft_matter (staging only), request_approval, and open_matter (gated).
3. Approval is a role-checked endpoint. The approver sees the draft, the matches found and the agent’s reasoning before deciding.
4. An audit log writes one structured record per run: every tool call, its arguments, a hash of the result, token counts and cost, with personal data redacted. The log is visible in the interface.
5. Identity through Microsoft Entra ID with application roles. A session-role fallback is documented for local development.

Evaluation plan

Twenty scenarios with planted conflicts of varying difficulty.

Measure	How it is scored
Conflict recall	Planted conflicts the agent found
False-positive rate	Clean scenarios flagged as conflicts
Escalation	Ambiguous matches sent to a person instead of being resolved by the model
Failure handling	A database timeout, malformed input, and an attempt planted in the email to skip approval
Gate integrity	A test that asserts open_matter never runs without an approval record
Speed and cost	Median and 95th-percentile time per scenario; cost per scenario

Human review points

One, and it is mandatory: the approver. The agent can recommend. It cannot open.

Known limitations going in

• Fuzzy matching on names is a known weak point in real conflicts systems. The near duplicates in the test data are there to keep the numbers honest.
• The identity integration has a time limit. If the enterprise login is slow to configure, the first version ships with session roles and documents the integration as the next step.

Changelog

• v0.0, Oct 13, 2026. Plan published. Build starts.