apc/gwyn // 6 duties · engineered controls · governance as code
ABA 512 → Architectural Controls
ABA Formal Opinion 512 defines six duties for lawyers using AI. Most candidates can name them. Almost none can map them to specific architectural controls. This map demonstrates that governance isn’t a policy memo — it’s engineered into the system. Every duty has a corresponding control that enforces compliance, not just advocates for it.
Why this separates Charlie from policy-only candidates: Gwyn is a senior K&I attorney. ABA 512 is her governing ethical framework. She will evaluate whether Charlie understands governance as an engineering discipline, not a compliance exercise. Perkins Coie fought a constitutional battle over client confidentiality. The AI program has to be built so confidentiality is structural — engineered into permissions from day one, not bolted on when compliance asks. That discipline is exactly what Charlie brings.
01
Duties to Controls
graph LR
%% ABA 512 DUTIES
D1["ABA 512
Competence"]:::duty1
D2["ABA 512
Confidentiality"]:::duty2
D3["ABA 512
Communication"]:::duty3
D4["ABA 512
Candor"]:::duty4
D5["ABA 512
Supervision"]:::duty5
D6["ABA 512
Reasonable Fees"]:::duty6
%% AESOP CONTROLS
subgraph CONTROLS["AESOP Architectural Controls"]
C1a["Quality Analysis
7-agent scoring"]:::ctrl1
C1b["Drift Detection
6-type monitoring"]:::ctrl1
C1c["KB Audit
pre-build validation"]:::ctrl1
C2a["Access-Control Arch.
data isolation"]:::ctrl2
C2b["Zero-Retention APIs
no training on data"]:::ctrl2
C2c["Audit Trails
boundary proof"]:::ctrl2
C3a["Portfolio Dashboard
adoption tracking"]:::ctrl3
C3b["Evaluation Reports
capability evidence"]:::ctrl3
C3c["Client Reporting
quarterly impact"]:::ctrl3
C4a["Accuracy Scorer
forensic verification"]:::ctrl4
C4b["Trace Analysis
failure taxonomy"]:::ctrl4
C4c["Hallucination Drift
production monitoring"]:::ctrl4
C5a["Human-in-the-Loop
escalation gating"]:::ctrl5
C5b["Sentinel Agent
QA test plans"]:::ctrl5
C5c["Custom Test Suite
scenario generation"]:::ctrl5
C6a["Time-Saved Tracking
per-matter metrics"]:::ctrl6
C6b["AFA Pricing Data
margin confidence"]:::ctrl6
C6c["Cost Dashboard
ROI per agent"]:::ctrl6
end
%% MAPPINGS
D1 --> C1a
D1 --> C1b
D1 --> C1c
D2 --> C2a
D2 --> C2b
D2 --> C2c
D3 --> C3a
D3 --> C3b
D3 --> C3c
D4 --> C4a
D4 --> C4b
D4 --> C4c
D5 --> C5a
D5 --> C5b
D5 --> C5c
D6 --> C6a
D6 --> C6b
D6 --> C6c
%% Styles
classDef duty1 fill:#ECE6FB,stroke:#7C3AED,color:#241A12,stroke-width:2px
classDef duty2 fill:#FBEBEA,stroke:#C23A30,color:#241A12,stroke-width:2px
classDef duty3 fill:#EAF2F9,stroke:#2F6FA8,color:#241A12,stroke-width:2px
classDef duty4 fill:#FAF0DC,stroke:#A5650A,color:#241A12,stroke-width:2px
classDef duty5 fill:#E9E7FB,stroke:#4F46E5,color:#241A12,stroke-width:2px
classDef duty6 fill:#E4F1EE,stroke:#0E7C6E,color:#241A12,stroke-width:2px
classDef ctrl1 fill:#FFFFFF,stroke:#7C3AED,color:#241A12,stroke-width:1px
classDef ctrl2 fill:#FFFFFF,stroke:#C23A30,color:#241A12,stroke-width:1px
classDef ctrl3 fill:#FFFFFF,stroke:#2F6FA8,color:#241A12,stroke-width:1px
classDef ctrl4 fill:#FFFFFF,stroke:#A5650A,color:#241A12,stroke-width:1px
classDef ctrl5 fill:#FFFFFF,stroke:#4F46E5,color:#241A12,stroke-width:1px
classDef ctrl6 fill:#FFFFFF,stroke:#0E7C6E,color:#241A12,stroke-width:1px
classDef subg fill:transparent,stroke:#CDBBA8,stroke-dasharray:6 4,color:#8C7E6E
class CONTROLS subg
Competence
Confidentiality
Communication
Candor
Supervision
Reasonable Fees
02
The Six Duties — Engineered Controls
Duty 1Competence
“Do you understand what this AI can and cannot do — and do you stay current as it changes?”
Quality Analysis — 7-agent parallel scoring on Instructions, Ethics, Bias, Safety, Functionality, Tone. 100-point scale with certification tier. Proves you know what the agent does.
Drift Detection — 6-type continuous monitoring (tone, scope, refusal, instruction erosion, hallucination, safety). If the underlying model changes, you know immediately.
KB Audit — 10 standardized issue types validated before any build. Proves the knowledge foundation is sound. Competence starts before the first prompt.
Quality Analysis — 7-agent parallel scoring on Instructions, Ethics, Bias, Safety, Functionality, Tone. 100-point scale with certification tier. Proves you know what the agent does.
Drift Detection — 6-type continuous monitoring (tone, scope, refusal, instruction erosion, hallucination, safety). If the underlying model changes, you know immediately.
KB Audit — 10 standardized issue types validated before any build. Proves the knowledge foundation is sound. Competence starts before the first prompt.
Duty 2Confidentiality
“Does Client A’s data ever surface in Client B’s output? Can you prove it didn’t?”
Access-Control Architecture — Role-based permissions walling data at the ingestion layer. Employment legal walled from commercial legal. The exact confidentiality gap that blocked prior tools — solved architecturally.
Zero-Retention API Endpoints — No training on client data. No cross-tenant leakage. Engineered, not promised.
Audit Trails — Every data access logged. Every boundary crossing provably prevented. The audit trail proves the boundary held — not a policy statement, a system record.
Access-Control Architecture — Role-based permissions walling data at the ingestion layer. Employment legal walled from commercial legal. The exact confidentiality gap that blocked prior tools — solved architecturally.
Zero-Retention API Endpoints — No training on client data. No cross-tenant leakage. Engineered, not promised.
Audit Trails — Every data access logged. Every boundary crossing provably prevented. The audit trail proves the boundary held — not a policy statement, a system record.
Duty 3Communication
“Does the client know you’re using AI? Do they understand what it does and doesn’t do?”
Portfolio Dashboard — Shows every deployed agent, adoption rates, and outcome metrics. Gives the relationship partner data to present: “Here’s what our AI did on your matters.”
Evaluation Reports — Per-agent scores with certification level. Transparent capability evidence. 68% of in-house counsel don’t know if outside firms use AI. This flips that.
Client Reporting — Quarterly impact summaries: time saved, accuracy metrics, scope of AI use. Proves value with data, not anecdotes.
Portfolio Dashboard — Shows every deployed agent, adoption rates, and outcome metrics. Gives the relationship partner data to present: “Here’s what our AI did on your matters.”
Evaluation Reports — Per-agent scores with certification level. Transparent capability evidence. 68% of in-house counsel don’t know if outside firms use AI. This flips that.
Client Reporting — Quarterly impact summaries: time saved, accuracy metrics, scope of AI use. Proves value with data, not anecdotes.
Duty 4Candor
“Are the AI’s outputs accurate? Or is it fabricating citations and presenting estimates as facts?”
Accuracy Scorer — Forensic citation verification. Claim-by-claim document comparison. Decomposes responses into discrete factual claims and exhaustively searches sources. Catches cherry-picked citations, omitted conditions, approximate numbers presented as exact.
Trace Analysis — Qualitative coding of failure moments. Groups errors into axial codes — hallucination patterns, fabrication signatures. Turns “the AI made something up” into categorized, fixable failure patterns.
Hallucination Drift Detection — Monitors production for fabrication rate changes. If hallucination spikes after a model update, flagged before the client sees it.
Accuracy Scorer — Forensic citation verification. Claim-by-claim document comparison. Decomposes responses into discrete factual claims and exhaustively searches sources. Catches cherry-picked citations, omitted conditions, approximate numbers presented as exact.
Trace Analysis — Qualitative coding of failure moments. Groups errors into axial codes — hallucination patterns, fabrication signatures. Turns “the AI made something up” into categorized, fixable failure patterns.
Hallucination Drift Detection — Monitors production for fabrication rate changes. If hallucination spikes after a model update, flagged before the client sees it.
Duty 5Supervision
“Is a qualified human reviewing the AI’s output? Or is the AI practicing law without a license?”
Human-in-the-Loop Gating — Low-confidence outputs escalate automatically. The system flags what needs review; the lawyer decides. ABA 512 doesn’t require reviewing every output — it requires knowing which outputs need review.
Sentinel Agent — Generates structured QA testing plans from evaluation findings. Human-readable and machine-executable. Ensures ongoing human oversight is systematic, not ad hoc.
Custom Test Suite — Generates domain-specific test scenarios. For legal: privilege boundaries, jurisdictional variation, confidentiality requirements. Supervision starts with knowing what to test.
Human-in-the-Loop Gating — Low-confidence outputs escalate automatically. The system flags what needs review; the lawyer decides. ABA 512 doesn’t require reviewing every output — it requires knowing which outputs need review.
Sentinel Agent — Generates structured QA testing plans from evaluation findings. Human-readable and machine-executable. Ensures ongoing human oversight is systematic, not ad hoc.
Custom Test Suite — Generates domain-specific test scenarios. For legal: privilege boundaries, jurisdictional variation, confidentiality requirements. Supervision starts with knowing what to test.
Duty 6Reasonable Fees
“Are you billing AI time as attorney time? Can you prove the fee is reasonable given the AI’s contribution?”
Time-Saved Tracking — Hours per task before vs. after AI. Per-matter, per-client. Quantifies the efficiency gain so AFAs are priced with confidence, not guesswork.
AFA Pricing Data — If a fixed-fee due diligence engagement takes 2 AI-assisted hours instead of 15, the firm can price that flat fee with margin. 85% of firms can’t do this. They’re guessing.
Cost Dashboard — ROI per agent: build cost, run cost, time saved, margin impact. Proves the fee is reasonable because it’s backed by data — not a narrative, a ledger.
Time-Saved Tracking — Hours per task before vs. after AI. Per-matter, per-client. Quantifies the efficiency gain so AFAs are priced with confidence, not guesswork.
AFA Pricing Data — If a fixed-fee due diligence engagement takes 2 AI-assisted hours instead of 15, the firm can price that flat fee with margin. 85% of firms can’t do this. They’re guessing.
Cost Dashboard — ROI per agent: build cost, run cost, time saved, margin impact. Proves the fee is reasonable because it’s backed by data — not a narrative, a ledger.
03
APC’s Governance Framework — Operationalized
APC published its AI governance framework — 5 principles — on day one of the merged firm. The principles are clear. What the firm needs is the operationalization: the architectural controls that prove every agent adheres to those principles before it touches a client matter.
The evaluation pipeline (15 methods, 6 stages) feeds the ABA 512 controls. Quality Analysis and Accuracy Scorer prove Competence and Candor. Access-control architecture and zero-retention endpoints enforce Confidentiality. Portfolio dashboards and evaluation reports satisfy Communication. Human-in-the-loop gating and Sentinel Agent fulfill Supervision. Time-saved tracking and AFA pricing data demonstrate Reasonable Fees. The audit trail isn’t a memo. It’s a system output.
04
Governance Is an Engineering Problem
Perkins Coie proved it will go to constitutional war to protect client confidentiality. The AI program has to be built so compliance is structural — engineered into permissions, audit trails, evaluation pipelines, and billing integration from day one. A policy memo doesn’t stop a data leak. Architecture does. That’s the standard the role demands. That’s the standard these controls enforce.