ABA 512 → Architectural Controls

apc/gwyn // 6 duties · engineered controls · governance as code

ABA Formal Opinion 512 defines six duties for lawyers using AI. Most candidates can name them. Almost none can map them to specific architectural controls. This map demonstrates that governance isn't a policy memo — it's engineered into the system. Every duty has a corresponding control that enforces compliance, not just advocates for it.

Why this separates Charlie from policy-only candidates: Gwyn is a senior K&I attorney. ABA 512 is her governing ethical framework. She will evaluate whether Charlie understands governance as an engineering discipline, not a compliance exercise. Perkins Coie fought a constitutional battle over client confidentiality. The AI program has to be built so confidentiality is structural — engineered into permissions from day one, not bolted on when compliance asks. That discipline is exactly what Charlie brings.

      graph LR
        %% ABA 512 DUTIES
        D1["ABA 512
Competence"]:::duty1
        D2["ABA 512
Confidentiality"]:::duty2
        D3["ABA 512
Communication"]:::duty3
        D4["ABA 512
Candor"]:::duty4
        D5["ABA 512
Supervision"]:::duty5
        D6["ABA 512
Reasonable Fees"]:::duty6

        %% AESOP CONTROLS
        subgraph CONTROLS["AESOP Architectural Controls"]
          C1a["Quality Analysis
7-agent scoring"]:::ctrl
          C1b["Drift Detection
6-type monitoring"]:::ctrl
          C1c["KB Audit
pre-build validation"]:::ctrl

          C2a["Access-Control Arch.
data isolation"]:::ctrl2
          C2b["Zero-Retention APIs
no training on data"]:::ctrl2
          C2c["Audit Trails
boundary proof"]:::ctrl2

          C3a["Portfolio Dashboard
adoption tracking"]:::ctrl3
          C3b["Evaluation Reports
capability evidence"]:::ctrl3
          C3c["Client Reporting
quarterly impact"]:::ctrl3

          C4a["Accuracy Scorer
forensic verification"]:::ctrl4
          C4b["Trace Analysis
failure taxonomy"]:::ctrl4
          C4c["Hallucination Drift
production monitoring"]:::ctrl4

          C5a["Human-in-the-Loop
escalation gating"]:::ctrl5
          C5b["Sentinel Agent
QA test plans"]:::ctrl5
          C5c["Custom Test Suite
scenario generation"]:::ctrl5

          C6a["Time-Saved Tracking
per-matter metrics"]:::ctrl6
          C6b["AFA Pricing Data
margin confidence"]:::ctrl6
          C6c["Cost Dashboard
ROI per agent"]:::ctrl6
        end

        %% MAPPINGS
        D1 --> C1a
        D1 --> C1b
        D1 --> C1c

        D2 --> C2a
        D2 --> C2b
        D2 --> C2c

        D3 --> C3a
        D3 --> C3b
        D3 --> C3c

        D4 --> C4a
        D4 --> C4b
        D4 --> C4c

        D5 --> C5a
        D5 --> C5b
        D5 --> C5c

        D6 --> C6a
        D6 --> C6b
        D6 --> C6c

        %% Styles
        classDef duty1 fill:#241a35,stroke:#a78bfa,color:#e8e0f0,stroke-width:2px
        classDef duty2 fill:#2a1a1a,stroke:#f87171,color:#fde0e0,stroke-width:2px
        classDef duty3 fill:#1a2e3d,stroke:#22d3ee,color:#cffafe,stroke-width:2px
        classDef duty4 fill:#2a2618,stroke:#fbbf24,color:#fef3c7,stroke-width:2px
        classDef duty5 fill:#2a1a18,stroke:#fb923c,color:#fde8d0,stroke-width:2px
        classDef duty6 fill:#1a2a1a,stroke:#4ade80,color:#dcfce7,stroke-width:2px

        classDef ctrl fill:#1a1830,stroke:#a78bfa,color:#d8cef0,stroke-width:1px
        classDef ctrl2 fill:#1a1830,stroke:#f87171,color:#d8cef0,stroke-width:1px
        classDef ctrl3 fill:#1a1830,stroke:#22d3ee,color:#d8cef0,stroke-width:1px
        classDef ctrl4 fill:#1a1830,stroke:#fbbf24,color:#d8cef0,stroke-width:1px
        classDef ctrl5 fill:#1a1830,stroke:#fb923c,color:#d8cef0,stroke-width:1px
        classDef ctrl6 fill:#1a1830,stroke:#4ade80,color:#d8cef0,stroke-width:1px

        classDef subg fill:transparent,stroke:#3a3050,stroke-dasharray:6 4,color:#9b8fb8
        class CONTROLS subg

Competence

Confidentiality

Communication

Candor

Supervision

Reasonable Fees

The Six Duties — Engineered Controls

"Do you understand what this AI can and cannot do — and do you stay current as it changes?"

Quality Analysis — 7-agent parallel scoring on Instructions, Ethics, Bias, Safety, Functionality, Tone. 100-point scale with certification tier. Proves you know what the agent does.
Drift Detection — 6-type continuous monitoring (tone, scope, refusal, instruction erosion, hallucination, safety). If the underlying model changes, you know immediately.
KB Audit — 10 standardized issue types validated before any build. Proves the knowledge foundation is sound. Competence starts before the first prompt.

"Does Client A's data ever surface in Client B's output? Can you prove it didn't?"

Access-Control Architecture — Role-based permissions walling data at the ingestion layer. Employment legal walled from commercial legal. The exact confidentiality gap that blocked prior tools — solved architecturally.
Zero-Retention API Endpoints — No training on client data. No cross-tenant leakage. Engineered, not promised.
Audit Trails — Every data access logged. Every boundary crossing provably prevented. The audit trail proves the boundary held — not a policy statement, a system record.

"Does the client know you're using AI? Do they understand what it does and doesn't do?"

Portfolio Dashboard — Shows every deployed agent, adoption rates, and outcome metrics. Gives the relationship partner data to present: "Here's what our AI did on your matters."
Evaluation Reports — Per-agent scores with certification level. Transparent capability evidence. 68% of in-house counsel don't know if outside firms use AI. This flips that.
Client Reporting — Quarterly impact summaries: time saved, accuracy metrics, scope of AI use. Proves value with data, not anecdotes.

"Are the AI's outputs accurate? Or is it fabricating citations and presenting estimates as facts?"

Accuracy Scorer — Forensic citation verification. Claim-by-claim document comparison. Decomposes responses into discrete factual claims and exhaustively searches sources. Catches cherry-picked citations, omitted conditions, approximate numbers presented as exact.
Trace Analysis — Qualitative coding of failure moments. Groups errors into axial codes — hallucination patterns, fabrication signatures. Turns "the AI made something up" into categorized, fixable failure patterns.
Hallucination Drift Detection — Monitors production for fabrication rate changes. If hallucination spikes after a model update, flagged before the client sees it.

"Is a qualified human reviewing the AI's output? Or is the AI practicing law without a license?"

Human-in-the-Loop Gating — Low-confidence outputs escalate automatically. The system flags what needs review; the lawyer decides. ABA 512 doesn't require reviewing every output — it requires knowing which outputs need review.
Sentinel Agent — Generates structured QA testing plans from evaluation findings. Human-readable and machine-executable. Ensures ongoing human oversight is systematic, not ad hoc.
Custom Test Suite — Generates domain-specific test scenarios. For legal: privilege boundaries, jurisdictional variation, confidentiality requirements. Supervision starts with knowing what to test.

"Are you billing AI time as attorney time? Can you prove the fee is reasonable given the AI's contribution?"

Time-Saved Tracking — Hours per task before vs. after AI. Per-matter, per-client. Quantifies the efficiency gain so AFAs are priced with confidence, not guesswork.
AFA Pricing Data — If a fixed-fee due diligence engagement takes 2 AI-assisted hours instead of 15, the firm can price that flat fee with margin. 85% of firms can't do this. They're guessing.
Cost Dashboard — ROI per agent: build cost, run cost, time saved, margin impact. Proves the fee is reasonable because it's backed by data — not a narrative, a ledger.

APC's Governance Framework — Operationalized

APC published its AI governance framework — 5 principles — on day one of the merged firm. The principles are clear. What the firm needs is the operationalization: the architectural controls that prove every agent adheres to those principles before it touches a client matter.

The evaluation pipeline (15 methods, 6 stages) feeds the ABA 512 controls. Quality Analysis and Accuracy Scorer prove Competence and Candor. Access-control architecture and zero-retention endpoints enforce Confidentiality. Portfolio dashboards and evaluation reports satisfy Communication. Human-in-the-loop gating and Sentinel Agent fulfill Supervision. Time-saved tracking and AFA pricing data demonstrate Reasonable Fees. The audit trail isn't a memo. It's a system output.

Governance Is an Engineering Problem

Perkins Coie proved it will go to constitutional war to protect client confidentiality. The AI program has to be built so compliance is structural — engineered into permissions, audit trails, evaluation pipelines, and billing integration from day one. A policy memo doesn't stop a data leak. Architecture does. That's the standard the role demands. That's the standard these controls enforce.