Use AI agents on client matters without putting confidentiality at risk.

01The problem: one agent, every matter

Lawyers use agents for contract review, e-discovery, research memos and drafting. An agent running on a lawyer's laptop can open every matter on it, every mailbox export and every saved credential. A document from the other side can carry hidden instructions, and an agent that follows them can send privileged material to any host it can reach.

ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. ABA Formal Opinion 512 (July 2024) applies that duty to generative AI tools. kosa8 provides technical measures that support those efforts; it does not replace the firm's own judgement.

02One sandbox per matter

Give each matter its own microVM and mount only that matter's folder, read-only for review work. The agent cannot see the rest of the laptop, and nothing it installs touches the host.

03Client documents go to a model only if you allow it

With --egress deny the sandbox has no network at all. If you use a hosted model, allow only that provider's host; the broker on the host adds the API key, so the key is never inside the sandbox. If documents must stay on site, serve a model locally through kosa8's OpenAI- and Anthropic-compatible gateway.

04Labels that keep matters apart

An org policy can define its own classification levels and caveats, and kosa8 recognises the ATTORNEY-CLIENT and ATTORNEY-WP markings. A label on a sandbox is inherited by its snapshots and forks and can be raised but not lowered; lowering it, or moving data sideways between labels that do not dominate each other, needs signed approvals from two people by default.

05Tool servers under one policy

Third-party MCP servers each run in their own sandbox behind kosa8's gateway, and a signed MCP policy decides which tools each team may call. Every allow and deny is recorded.

06A record of what the AI touched

The audit log marks every action as human, agent or tool, chained by hash so edits and deletions show. For a client or an auditor, export a signed evidence package for one sandbox; they can check it without kosa8, including in a browser with the offline verifier.

07Close the matter cleanly

When the matter ends, remove the sandbox with a wipe: kosa8 overwrites and verifies its disks and records the wipe in the audit log.

08How to start

Pilot on one lawyer's or one practice-support machine with a closed matter or sample documents.

1. Install kosa8 on an Apple silicon Mac or x86-64 Linux, then start the daemon.

   curl -fsSL https://kosa8.com/install.sh | shCOPY kosa8 daemon startCOPY

2. Create a sandbox for one matter with no network, then confirm the audit log verifies.

   kosa8 sandbox create pilot --mount ~/matters/sample:/work:ro --egress denyCOPY kosa8 audit verifyCOPY

09Questions

Does using kosa8 satisfy ABA Model Rule 1.6?

No tool satisfies a professional duty on its own; reasonable efforts are judged on the firm's whole practice. kosa8 provides technical measures that support those efforts: a separate machine per matter, a closed network, keys held outside the sandbox, and a record you can verify.

Do our documents go to kosa8?

No. kosa8 runs on your machines and has no telemetry; sandboxes, files, commands, snapshots and audit logs stay where kosa8 runs. Documents reach a model provider only if you allow that provider's host, and with a local model they do not leave the machine.

Can a client or auditor check what the AI did without installing kosa8?

Yes. kosa8 evidence export writes a signed package of the audit entries about a sandbox, and kosa8 evidence verify --web writes a single HTML file that checks such a package offline in a browser.

10Further reading

• How do I stop an AI agent reading .env files and secrets?
• How do I give an AI agent API keys without exposing them?
• How do I run MCP servers in a sandbox?
• How do I run a coding agent with a local model?
• Secure AI agents for law firms: protecting privilege and data
• Prompt injection, API keys and the egress broker

11Sources

• American Bar Association: Model Rule 1.6, Confidentiality of Information
• American Bar Association: Formal Opinion 512, Generative Artificial Intelligence Tools
• kosa8 docs: Audit log
• kosa8 docs: Governance
• kosa8 docs: Local models

12Get kosa8

Install kosa8 on one machine and open a sandbox for a sample matter. Firm-wide terms are on the pricing page.