Tutorial 09: Custom Legal Skills, Guardrails & Agents (OpenAI)

OPENAI STACK
|
+-- CUSTOM GPTs
|   +-- Custom instructions and knowledge files
|   +-- Persistent context for matter-specific workflows
|
+-- ASSISTANTS API
|   +-- Multi-turn conversations with tools
|   +-- File search and code interpreter
|   +-- Orchestration via threads and runs
|
+-- MODERATION & GUARDRAILS
|   +-- Moderation API: input/output content classification
|   +-- Custom wrappers: audit logging, compliance checks
|
+-- FUNCTION CALLING
|   +-- Connect to external tools and data sources
|
+-- ACTIONS (Custom GPTs)
    +-- OpenAPI-defined integrations for ChatGPT

# Contract Review Skill

## Purpose
This skill provides comprehensive contract review capabilities
aligned with [Firm Name]'s standard practices.

## Activation
Apply this skill when:
- User uploads a contract document
- User mentions "contract review" or similar
- User references specific contract types (NDA, MSA, SaaS, etc.)

## Process

### Step 1: Classification
Before analyzing, identify:
1. Contract Type: NDA, MSA, SaaS, License, Services, etc.
2. Our Role: Which party do we represent?
3. Counterparty Profile: Enterprise, mid-market, startup?
4. Deal Tier: Estimated value and strategic importance

### Step 2: Document Processing
- Read entire contract before providing analysis
- Note all defined terms and their definitions
- Identify governing law and dispute resolution
- Map clause structure and cross-references

### Step 3: Playbook Application
Apply positions from playbook:
- Compare each clause to standard position
- Identify deviations and assess severity
- Note missing required provisions

### Step 4: Risk Assessment
For each issue:
- Assign severity: RED | YELLOW | GREEN
- Explain practical business impact
- Consider interaction with other clauses

### Step 5: Redline Generation
For RED and YELLOW issues:
- Provide specific alternative language
- Reference clause library when applicable
- Explain rationale for changes

### Step 6: Output Generation
Structure response as:
1. Executive Summary (3-5 sentences)
2. Deal Parameters Table
3. Clause-by-Clause Analysis
4. Risk Score and Escalation Recommendation
5. Negotiation Priorities
6. Questions for Business Team

## Quality Requirements
- Never provide legal advice without qualification
- Flag any clause requiring jurisdictional verification
- Note when playbook doesn't cover specific terms
- Recommend escalation for deals over $500K

{
  "contract_types": {
    "SaaS_Customer": {
      "liability": {
        "standard": "12 months fees",
        "minimum": "total contract value",
        "carve_outs": ["indemnification", "data_breach", "confidentiality", "IP", "gross_negligence", "willful_misconduct"]
      },
      "indemnification": {
        "required_vendor": ["IP_infringement", "data_breach", "security_failure"],
        "acceptable_exclusions": ["customer_modifications", "third_party_components_with_notice"]
      },
      "data": {
        "ownership": "customer",
        "vendor_rights": "service_delivery_only",
        "prohibited_uses": ["AI_training", "analytics", "marketing", "sale"],
        "retention_limit": "30_days_post_termination"
      }
    }
  },
  "severity_matrix": {
    "RED": [
      "unlimited_customer_liability",
      "no_vendor_indemnity",
      "data_used_for_AI_training",
      "no_termination_for_convenience"
    ],
    "YELLOW": [
      "liability_cap_below_12_months",
      "narrow_indemnity_carveouts",
      "60_plus_day_termination_notice"
    ]
  }
}

# Approved Clause Language Library
 
## Limitation of Liability
 
### Standard Mutual Cap
"EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THIS
AGREEMENT SHALL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER
IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM."
 
### Uncapped Carve-Outs Addition
"THE FOREGOING LIMITATION SHALL NOT APPLY TO: (A) EITHER PARTY'S
INDEMNIFICATION OBLIGATIONS; (B) BREACH OF SECTION [DATA SECURITY];
(C) BREACH OF CONFIDENTIALITY OBLIGATIONS; (D) EITHER PARTY'S
GROSS NEGLIGENCE OR WILLFUL MISCONDUCT; OR (E) CUSTOMER'S PAYMENT
OBLIGATIONS."
 
## Data Ownership
 
### Customer Ownership Clause
"As between the parties, Customer retains all right, title, and
interest in and to Customer Data. Vendor acquires no rights in
Customer Data except the limited license granted herein."
 
### No AI Training Clause
"Vendor shall not use Customer Data or any derivatives thereof
to train, develop, or improve any machine learning model,
artificial intelligence system, or similar technology."

# NDA Triage Skill

## Purpose
Rapid classification of incoming NDAs for routing.

## Activation
Apply when user uploads NDA or requests "triage this NDA."

## Process
1. Identify NDA type (mutual/one-way, direction)
2. Scan for non-standard terms: non-solicit, jurisdiction, term length, carve-outs
3. Compare to our standard NDA template
4. Assign GREEN/YELLOW/RED with specific flagged items
5. Output: Triage result, flagged items, recommendation

## Standard Items (No Flag)
- Mutual obligations, 3-year term, standard exclusions, return/destruction

## Non-Standard (Flag for Review)
- Non-solicit, jurisdiction other than Delaware, term >5 years, broad carve-outs

// Conceptual: Wrap OpenAI calls to log all legal AI interactions
async function legalAICall(prompt, options) {
  const startTime = Date.now();
  const response = await openai.chat.completions.create({
    model: options.model ?? "gpt-5.5",
    messages: [{ role: "user", content: prompt }],
    ...options
  });
  await auditLog.write({
    timestamp: new Date(),
    duration: Date.now() - startTime,
    promptHash: hash(prompt),
    model: options.model,
    tokenCount: response.usage?.total_tokens
  });
  return response;
}

// Check user input before sending to model
const moderation = await openai.moderations.create({
  input: userPrompt
});
if (moderation.results[0].flagged) {
  return { error: "Content flagged. Please revise." };
}

// Due Diligence Multi-Agent Workflow (Conceptual)
// Existing Assistants API pattern; prefer Responses API for new builds.
 
const reviewTasks = [
  { name: 'contract-reviewer', assistantId: 'asst_xxx', instructions: 'Apply customer agreement playbook' },
  { name: 'ip-reviewer', assistantId: 'asst_yyy', instructions: 'Apply IP agreement playbook' },
  { name: 'employment-reviewer', assistantId: 'asst_zzz', instructions: 'Apply employment agreement playbook' },
  { name: 'litigation-reviewer', assistantId: 'asst_www', instructions: 'Assess litigation exposure and reserves' }
];
 
// Create a thread per task (or reuse); run in parallel
const results = await Promise.all(
  reviewTasks.map(async (task) => {
    const thread = await openai.beta.threads.create();
    const run = await openai.beta.threads.runs.create(thread.id, {
      assistant_id: task.assistantId,
      additional_instructions: task.instructions
    });
    return { task: task.name, run };
  })
);
 
// Poll for completion, then synthesize with a current model.
const synthesis = await openai.chat.completions.create({
  model: "gpt-5.5",
  messages: [{
    role: "user",
    content: `Synthesize due diligence findings from ${results.length} reviewers into: Executive Summary, Critical Issues, Risk Matrix, Recommended Deal Adjustments.`
  }]
});

// Legal Research + Drafting Multi-Step Workflow (Conceptual)
// For web search, see Responses API built-in tools: platform.openai.com/docs/guides/tools
 
async function researchAndDraft(topic, jurisdiction, outputType) {
  // Stage 1: Research (add web/file tools through the Responses API where appropriate)
  const research = await openai.chat.completions.create({
    model: "gpt-5.5",
    messages: [{
      role: "user",
      content: `Research ${topic} under ${jurisdiction} law. Provide comprehensive analysis with citations. Format as structured legal memorandum outline.`
    }]
  });
 
  // Stage 2: Draft (uses research output)
  const draft = await openai.chat.completions.create({
    model: "gpt-5.5",
    messages: [
      { role: "user", content: `Research: ${research.choices[0].message.content}` },
      { role: "user", content: `Draft a ${outputType} addressing ${topic}. Include all relevant citations. Follow firm style guide.` }
    ]
  });
 
  // Stage 3: Review
  const review = await openai.chat.completions.create({
    model: "gpt-5.5",
    messages: [{
      role: "user",
      content: `Review this draft for: 1) Legal accuracy 2) Citation completeness 3) Style compliance 4) Missing analysis. Draft: ${draft.choices[0].message.content}`
    }]
  });
 
  return { research, draft, review };
}

legal-contract-assistant/
├── instructions.md           # Main skill instructions (Assistant instructions)
├── playbook.json             # Standard positions, risk thresholds
├── clause-library.md         # Approved redline language
├── examples/
│   ├── good-review.md        # Calibration reference
│   └── bad-review.md         # Anti-pattern to avoid
└── README.md                 # Setup and usage notes

// Conceptual: Sanitize output before returning to user
async function safeLegalResponse(prompt, options) {
  const response = await openai.chat.completions.create({
    model: options.model ?? "gpt-5.5",
    messages: [{ role: "user", content: prompt }],
    ...options
  });
  const content = response.choices[0].message.content;
  // Remove potential PII patterns before returning
  const sanitized = content.replace(/\b[A-Z]{2,}\s+[A-Z][a-z]+\b/g, "[REDACTED]");
  await auditLog.write({ /* ... */ });
  return { ...response, content: sanitized };
}

## Output Format
 
Structure every contract review response as:
 
1. **Executive Summary** (3-5 sentences)
2. **Deal Parameters Table** (counterparty, type, term, value)
3. **Clause-by-Clause Analysis** (issue | severity | recommendation)
4. **Risk Score** (RED/YELLOW/GREEN) and escalation recommendation
5. **Negotiation Priorities** (must-have vs nice-to-have)
6. **Questions for Business Team**

# Custom GPTs
chat.openai.com -> Create GPT -> Configure instructions and knowledge

# Responses API / Assistants migration
openai.responses.create({ model, input, tools })

# Existing Assistants API systems
openai.beta.assistants.create({ instructions, model, tools })
openai.beta.threads.create()
openai.beta.threads.runs.create(thread_id, { assistant_id })

# Moderation
openai.moderations.create({ input: user_content })