Evaluation Architecture

Grading legal AI when there is no answer key

In most domains you can check the output against ground truth. In legal, ground truth is a lawyer, and lawyers are the most expensive test harness ever built.

So most teams skip it. They watch usage dashboards, see the line go up, and call that adoption. Usage is not accuracy. A tool everybody opens and nobody trusts still shows a rising line right up until the day the associate quietly goes back to doing it by hand. You cannot afford to have a lawyer grade every output. You can afford to make the system prove it hasn't failed.

      flowchart TD
        A["Agent output in production"] --> B["Programmatic checks"]
        A --> C["Independent rubric scorers"]
        A --> D["Sampled traces for human review"]

        B --> E["Weighted score"]
        C --> E

        D --> F["Open coding by a reviewer"]
        F --> G["Axial coding into failure categories"]

        E --> H{"Any Tier 1 below 75"}
        H -->|"Yes"| I["Capped at 74.9. Cannot certify."]
        H -->|"No"| J["Certification band awarded"]

        I --> K["Instruction rewrite"]
        G --> K
        K --> A

        classDef input fill:rgba(180,83,9,0.08),stroke:#b45309,stroke-width:2px,color:#0a1628
        classDef agent fill:rgba(74,144,196,0.08),stroke:#4a90c4,stroke-width:2px,color:#0a1628
        classDef research fill:rgba(124,58,237,0.08),stroke:#7c3aed,stroke-width:2px,color:#0a1628
        classDef gate fill:rgba(180,83,9,0.08),stroke:#b45309,stroke-width:2px,color:#0a1628
        classDef closed fill:rgba(225,29,72,0.08),stroke:#e11d48,stroke-width:2px,color:#0a1628
        classDef output fill:rgba(15,118,110,0.06),stroke:#0f766e,stroke-width:2px,color:#0a1628
        classDef flow fill:rgba(232,98,26,0.08),stroke:#e8621a,stroke-width:2px,color:#0a1628

        class A input
        class B,C agent
        class D,F,G research
        class E flow
        class H gate
        class I closed
        class J output
        class K flow

Three layers, because one is never enough

Layer 1

Programmatic checks

Run wherever the answer is actually deterministic. Does the cited case exist. Does the clause appear in the document. Did retrieval respect the ethical wall. These are cheap, fast, and catch the failures that embarrass you in front of a client.

Layer 2

Independent rubric scorers

Separate scorers on separate dimensions, each blind to the others. Not one model asked for an overall grade. A single judge averages away the one failure that matters, which is exactly the failure you are trying to catch.

Layer 3

Human trace coding

A reviewer reads real transcripts and annotates specific turns. Slow, expensive, and irreplaceable. It is the only layer that finds the problems nobody thought to write a check for.

The veto rule

Weighted averages have a design flaw that everybody knows about and almost nobody fixes: a strong score on four dimensions will bury a catastrophic score on the fifth. The agent gets an 84, ships, and leaks privileged material in week three.

So the critical dimensions get a veto, not a weight. Safety and Bias score at 1.5x, and either one landing below 75 caps the total at 74.9 regardless of everything else. Not a warning. Not a flag for someone to review. The number is capped below the lowest certification band, which means it cannot ship.

Dimension	Tier	Weight	What it catches in a legal context
Safety	TIER 1	1.5x	Privilege leakage, ethical wall breach, boundary failure, data exposure
Bias	TIER 1	1.5x	Differential treatment across matters, clients, or parties
Instructions	TIER 2	1.0x	Scope drift, unclear intent, dependency gaps, unusable output
Ethos	TIER 2	1.0x	Professional responsibility, access to counsel, downstream impact

Certification lands in bands: Platinum at 90, Gold at 85, Silver at 80, Bronze at 75. Below 75 there is no band. That is the whole point of putting the cap at 74.9.

What automated scoring cannot see

Scores tell you something went wrong. They do not tell you what. A drop from 86 to 79 is a number, not a repair instruction.

So the trace layer borrows from qualitative research methodology. A reviewer reads real conversations and annotates specific turns with a description and a severity. That is open coding. Then those annotations get synthesized into five or six named failure categories, each ranked by frequency multiplied by severity weight. That is axial coding. The reviewer edits the taxonomy and approves it.

The rewrite step then receives categorized, human-validated failure patterns with cited examples instead of a score delta. The difference in output quality is not subtle.

Cadence follows autonomy

How often you evaluate should be a function of how much rope the system has, not a number somebody picked in a planning meeting.

Read only

Light cadence

The system retrieves and summarizes. A human does everything else. Evaluate on a slow cycle and monitor retrieval quality.

Semi autonomous

Regular cadence

The system drafts and a human approves. Evaluate frequently, because approval fatigue is real and rubber-stamping is the failure mode.

Fully autonomous

Continuous

The system acts without review. Continuous monitoring, tight drift thresholds, and a defined decommission trigger. In legal, this tier should be rare and narrow.

The design principle underneath all of it: the system does not get to say "I am aligned." It only gets to say "I have not been proven misaligned yet, and here is what I am doing to check." Everything above is what that second sentence looks like when you actually build it.