Agents

Legal work needs density, not dialogue.

Governance needs to be in the architecture conversation, not the incident response.

Not all AI agents carry the same legal risk. Your governance framework should distinguish between reflex agents, learning agents, and multi-agent systems — because the liability profile is fundamentally different. https://www.databricks.com/blog/types-ai-agents-definitions-roles-and-examples

AI agents are moving from retrieving data to building memories about users. Most privacy frameworks weren't designed for that shift — and the gap is widening fast.

What compliance teams haven't figured out yet is that they own this problem.

Engineers call this context management. Lawyers should call it something else: selective deletion with no retention policy.

AI agents with memory aren't just smarter — they're harder to govern. Each memory layer creates distinct privacy and retention obligations product counsel needs to address at the architecture stage.

MCP servers let AI agents access your APIs without custom code. Most weren't built for production security. That gap between "works in demo" and "safe at scale" is where the liability lives.