Set the firm's rules. Hold every surface to them.

Sending, signing, filing with a court, moving client funds and changing a matter's phase stop for a person at every setting, on every matter. The screen names those five categories rather than a tool count, because the count moves with the registry.

Each rung states what it does, what it still will not do, and what actually changes by moving to it. Two of the five change no behaviour at present, and their rows say so in those words.

Lowering a capability to unattended needs a decision-gold evaluation fresh within thirty days, pinned by seed and gold-set digest, with zero must-not-call violations. It also needs that attorney's supervised history: ten resolved decisions, no decline in fourteen days. Either half missing leaves the higher floor.

Every attorney starts at the bottom rung: a firm-wide lowering does not carry to an un-promoted lawyer, while a firm-wide raise toward more confirmation is always honoured. A promotion advances one rung at a time, and lowering your own autonomy is never blocked.

A member cannot be added straight into the attorney role. They join as paralegal or admin, and promotion requires a verified bar licence and a licence number on record, checked again at the promotion route. The role is read from the acting firm's membership row.

The firm-creation door refuses an account with an existing client link, and refuses too when that probe cannot be read, since admitting one is permanent and self-elevating while refusing costs a retry. A new account with no client link is the ordinary front door.

An ethical wall is checked on every read rather than at assignment, and again by row-level security. An imputed cross-matter hit auto-provisions a provisional screen pending review. An administrator screened off a matter cannot hand it to anyone, because their own reach is re-derived first.

With no threshold set, every posting takes the path it takes today. Set a dollar figure and any outflow at or above it is held for a second licensed attorney. Deposits are never gated. Both database functions that write the trust ledger sit behind it.

Releasing a held disbursement takes a licensed attorney who is not the requester, so arming the threshold at a one-attorney firm would brick the trust account above that figure. Arming is refused with the reason and the fix. Clearing the threshold always works.

One predicate serves the setter and the approve route, so the setting cannot promise what the release refuses. A member outside the firm never learns it exists; a paralegal inside is told it takes an attorney; a failed probe reports that it could not tell.

Which vendors may receive client content is a reviewed constant in code, asserted at the credential factory before a key is read. An environment variable can narrow that set to a sovereign endpoint, never widen it. The screen shows it read-only: picking is not approving.

A firm chooses among already-approved vendors and declares which it holds a zero-retention agreement with. Two vendors refuse client content outright without that declaration, at the firm layer and the deployment layer. An unread selection leaves the reviewed default standing; an unread declaration is refused.

Routed inference carries a no-collection instruction on every request as the baseline. A firm may raise its own minimum to zero-retention and a deployment variable may raise it too. Neither can loosen the baseline beneath deny.

The firm picks a model per registered task from the eligible set the server derives from the code registries, the task's floor and ceiling, and the routed measurement gate. A stored string is accepted only by exact membership, so an ineligible choice shows as subtracted.

A credential is minted in one of two classes and the class cannot change: the lifecycle verbs are create and revoke. A client-safe key is forced into the privilege-gated view on every connection whatever its arguments ask. Minting the attorney class takes a firm administrator.

A key can be minted to read the knowledge graph only, or to check text an add-in holds, reading nothing from the firm. Work queues and attorney analysis are refused to a client-safe key outright. A matter allow-list intersects server-side, so it can only narrow.

A grant names one firm, its matters, an expiry and a capability set closed at read, upload and propose. Minting takes a firm administrator who reaches it. Every exercise re-derives the key's reach, the issuer's reach and the scopes, and the database adjudicates single use.

A firm can stop banking work product to its corpus, or refuse cloud transcription of a recording. Every switch in the catalogue makes the software do less, so a wrong flip costs a capability, not a gate. Each entry names the file that reads it.

The firm writes down its register, sentence length, hedging and the terms it will not print. Each attorney's profile overrides the scalar fields, while preferred and prohibited terms survive by union, so a personal profile cannot drop a firm prohibition. It relaxes no citation rule.

Prompt text is registry-backed, editable by a firm admin and version-logged. A named set resolves to the in-code text whatever any stored row says: the privilege classifier, the client-facing chat guardrails, the client explainer, the intake protocol and the ingest classifier. They list as locked.