Skip to main content

Legal Privilege

The legal-privilege policy blocks selected legal phrases during the output phase. It uses configured markers or a small built-in list. A marker match blocks the response.

The marker match does not determine if legal privilege exists, applies, or was waived.

Configuration​

pack:
  name: legal-privilege
  version: "1.0.0"
  enabled: true

policies:
  chain:
    - legal-privilege

policy:
  legal-privilege:
    privilege_markers:
      - "attorney-client privilege"
      - "privileged and confidential"
      - "work product"
      - "for legal review only"

Fields​

FieldTypeDescriptionDefault
privilege_markersstring[]Markers are not case-sensitive. A marker blocks matching output. If the field is not specified, the policy uses the built-in list above.built-in list
actionblockThis is the only accepted action. A match always blocks the output.block

How it works​

  1. Output text: The server gets response text from the buffered model output.
  2. Marker check: The gateway changes the text to lowercase and examines each configured or built-in marker.
  3. Verdict: A match returns Verdict::Block with reason_code = "legal.privilege_detected".
  4. Audit details: The decision event records the match state and the number of active markers.

Important limitations​

  • The active policy evaluates output text only. It does not examine inbound prompts.
  • There is no redact or escalate mode for this policy.
  • action is optional because blocking is the only supported runtime behavior.
  • Use stream: false. The active SSE path does not run this evaluator.

Correct examples​

Use built-in defaults​

pack:
  name: legal-defaults
  version: "1.0.0"
  enabled: true

policies:
  chain:
    - legal-privilege

policy:
  legal-privilege: {}

Add specified organization privilege markers​

pack:
  name: litigation-review
  version: "1.0.0"
  enabled: true

policies:
  chain:
    - legal-privilege

policy:
  legal-privilege:
    privilege_markers:
      - "attorney-client privilege"
      - "work product"
      - "for legal review only"
      - "settlement draft"
      - "outside counsel only"

Best practices​

  • Put the policy in output chains that make legal analysis, summaries, or draft memoranda.
  • Add applicable legal or organization labels to privilege_markers.
  • Pair with case-privacy, upl-filter, and pii-detector for broader legal-data controls.

Next steps​