Firms are adopting a dozen AI tools with no common accountability layer. Each vendor keeps its own logs, writes its own confidentiality terms, and offers no way to prove to a court, a client, or a regulator what happened across all of them at once. The direction RankShield Legal is building toward is a neutral gateway: the tools keep doing the work, and RankShield produces the verifiable record. That is the agent-governance layer the legal-AI market does not yet have, and it is the natural extension of two capabilities the platform already runs — citation certification and privilege-isolation attestation. To be clear about where this stands: the gateway itself is on the roadmap and under active design. The primitives beneath it are live.
What is the AI-tool attestation gateway?
The gateway is a planned checkpoint that would sit between the AI tools your firm already uses and the work product those tools help produce. Instead of each research assistant, drafting copilot, and agentic workflow keeping its own private record, the firm would route consequential AI-assisted actions through one verifiable point. At that point, RankShield would produce a signed attestation describing what the tool did, which authorities it resolved, and how privileged material was handled — then seal that record to a transparency log so it can be checked later by anyone the firm chooses to show it to.
It helps to say plainly what the gateway is not. It is not another drafting tool, not a model, and not a replacement for the AI products your lawyers rely on. It does not read the merits of a matter or judge whether an argument is correct. It is a record-producing layer. The tools generate the work; the gateway generates verifiable evidence about how that work was assisted. And, again, it is in development — the description here is the design intent, not a live surface you can point traffic at today.
The reason this shape matters is that accountability in a multi-tool firm has become fragmented. A litigator might use one product for research, another for drafting, and an agentic workflow for document review, each with different retention policies and different confidentiality language. When a client, an adversary, or a court asks a simple question — what did your AI tools actually do here — there is no single answer to give. The gateway is designed to make that answer exist, in a form that does not depend on trusting any one vendor's word.
Why would a firm want one checkpoint in front of every AI tool?
The alternative to a shared checkpoint is what most firms have now: a scatter of vendor dashboards, none of which talk to each other, and none of which produce a record an outside party can independently verify. That works until someone asks a hard question. When a client's general counsel runs an AI-use audit, or opposing counsel probes how a brief was assembled, a firm needs to show a coherent account across every tool at once — not export six different logs and hope they line up.
A single governed checkpoint changes the firm's posture from explaining to demonstrating. Rather than describing its AI controls in a policy document and asking to be believed, the firm can point to signed records that were produced at the moment each action happened. The same checkpoint is where a firm would set policy: which tools are approved, what each is allowed to touch, and what consent must be on file before a tool acts. That governance view is the sibling capability described on the AI governance dashboard page.
How would the gateway actually work?
- A firm registers its approved AI toolsThe firm declares which AI products and agentic workflows are allowed to operate under governance — its research assistant, its drafting copilot, and any agent that takes multi-step actions. Each tool is given an identity so that later attestations can be bound to a specific, named actor rather than an anonymous process. Nothing here is a live signup flow yet; this is the intended onboarding shape.
- A consequential action passes through the checkpointWhen an approved tool takes a step that matters — pulling authorities into a draft, touching a client file, or having an agent execute part of a workflow — the request would be signed on its way through the gateway using HTTP Message Signatures, so the record is tied to the tool that made it and cannot be quietly reattributed afterward.
- RankShield resolves citations and checks isolationThe gateway would run the two live primitives against the action: it confirms that cited authorities were actually resolved rather than asserted, and it attests that privileged material stayed inside its isolation boundary. It does not read the argument's merits. It records structural facts about how the action was handled.
- A signed attestation is sealed to the transparency logThe result — action, tool identity, governing policy, and consent status — would be signed with the platform's post-quantum scheme and appended to the same public transparency log the platform uses today. That gives the firm a record it can hand to a client or a court, which they can verify without taking RankShield's word for it.
What would it attest — and what would it never attest?
This distinction is the load-bearing honesty of the whole design, so it is worth being blunt about. The gateway would attest structural, checkable facts: that a tool with a known identity took a specific action, that the authorities it cited were resolved, that privileged material was isolated according to policy, and that the required consent was on file. Those are things a machine can verify and a third party can re-verify. They are the same categories the shipped capabilities already attest — the gateway simply extends them from a per-filing checkpoint to a per-action one.
- It attests architecture — that an AI action ran inside the isolation and policy structure the firm defined.
- It attests isolation — that privileged or confidential material stayed within its boundary during the action.
- It attests consent — that the informed-consent posture a firm's ethical duties require was recorded before the tool acted.
- It does not attest that a legal conclusion is right, that a brief will win, or that an argument is sound. Those are lawyer judgments, and no attestation touches them.
- It does not, and cannot, guarantee an AI tool produced no errors. It records how the action was handled, not that the output is flawless. There is no such thing as a hallucination-free guarantee, and we will not imply one.
- It does not by itself preserve privilege as a legal matter. It attests that an isolation architecture was followed; whether privilege holds is a legal question for the firm and, ultimately, a court.
Which standards would the gateway build on?
The gateway would not invent a private accountability scheme. It would compose public, published standards — the same ones the platform already runs — because a record is only as trustworthy as the openness of the machinery that produced it. If verification depended on a proprietary format only RankShield could read, it would not be worth much to a court or a client. The point of building on open standards is that anyone can check the result independently, without trusting us.
| Standard | What it does | Role in the gateway |
|---|---|---|
| IETF RATS (RFC 9334) | Remote attestation architecture | Defines how a claim about an AI action is structured, conveyed, and appraised so it means the same thing to every reader. |
| RFC 9421 | HTTP Message Signatures | Signs each tool request as it passes the checkpoint, binding the action to the tool's identity. |
| NIST FIPS 204 / 205 | ML-DSA and SLH-DSA signatures | The composite post-quantum scheme used to sign each attestation, matching what the platform signs with today. |
| RFC 6962 | Certificate Transparency logs | Appends each attestation to a public, append-only log so records can be independently verified later. |
Why is a shared gateway how a small firm gets AI governance?
A large firm can staff an AI-governance committee, hire an in-house security team, and build its own controls around every tool it adopts. A ten-lawyer firm cannot. It faces the same Rule 11 duty of candor, the same client audit demands, and the same ethical obligations around confidentiality — but without the headcount or budget to build governance from scratch. That gap is exactly where the market leaves smaller firms exposed.
The design answer is a shared, verifiable gateway: enterprise-grade AI governance delivered at a firm's size. Because the checkpoint, the standards, and the transparency log are built once and offered as a common layer, a small firm can route its tools through governance it could never engineer in-house. The phrase we hold ourselves to is enterprise-grade, firm-sized — the same rigor a large firm builds internally, reachable by a firm that has no internal team to build it. When it ships, this is the promise it has to keep.
How would this help evidence a firm's professional duties?
AI use in legal work sits on top of duties that already exist. ABA Formal Opinion 512 addresses a lawyer's obligations when using generative AI, including informed consent under Model Rule 1.6 when confidential information may be exposed to a tool. FRCP Rule 11 requires that filings be grounded in a reasonable inquiry. Neither duty is created by RankShield, and neither is satisfied by RankShield — they are the lawyer's to meet. What the gateway is designed to do is help a firm evidence that it met them.
Consent is a good example. Opinion 512 turns on whether the right consent was obtained before confidential material reached a tool. A firm can have a sound consent process and still struggle to prove, after the fact, that it was followed for a specific action. The gateway would record the consent posture at the moment the tool acted, so the firm has contemporaneous evidence rather than a reconstruction. Similarly, where Rule 11 asks whether cited authorities were checked, the citation-certification primitive records that the authorities in a given action were resolved rather than merely asserted. None of this is legal advice, and none of it substitutes for a lawyer's own judgment. It is evidence infrastructure for duties the lawyer still owns. The reasoning behind attestation over assertion is laid out on why verifiable.
How is this different from a vendor's own logs?
Most AI vendors keep logs, and those logs are useful for debugging and support. But they answer to the vendor, not to the firm's clients or the court. A vendor log lives inside the vendor's system, follows the vendor's retention policy, is presented in the vendor's format, and ultimately asks an outside reviewer to trust the vendor's account of what happened. When several tools are involved, there is no single vendor whose log covers the whole picture, and no neutral party stitching them together.
A neutral gateway inverts that. The record is produced at a checkpoint the firm controls, in an open format, and sealed to a public transparency log — so its integrity does not depend on any one vendor's goodwill or survival. If a tool vendor changes its terms, loses its logs, or goes out of business, the firm's attested record still stands and can still be verified. That independence is the whole reason to build a separate layer rather than lean on the logging each vendor already ships. A record you have to trust the subject of is a weaker thing than a record anyone can check.
What are the common misconceptions about this page?
-
MythThe attestation gateway is a product I can buy and switch on today.
TruthIt is not. The gateway is a roadmap capability in active development. What is live today are the two primitives beneath it — citation certification and privilege-isolation attestation. The gateway is the integration layer being designed on top of them.
-
MythRouting AI tools through the gateway makes their output hallucination-free.
TruthNo system can promise that, and this one does not try. The gateway would record how an AI action was handled — identity, citation resolution, isolation, consent. It does not make a model incapable of error, and we never describe it as if it does.
-
MythAn attestation means the firm's privilege is legally preserved.
TruthIt attests that an isolation architecture was followed. Whether privilege is preserved is a legal question for the firm and a court. Architecture is what a machine can verify; legal effect is not.
-
MythPost-quantum signing means the records are unbreakable forever.
TruthThe platform's signatures are quantum-safe, meaning built on schemes standardized against known quantum attacks. Quantum-safe is not the same as quantum-proof, and we do not claim permanence. Cryptography advances, and so will the platform.
Honest status: where this really stands
- This is a roadmap capability, not a live product surface. We describe it in the open so design-partner firms can help shape it before it ships. Nothing on this page is available to turn on today.
- The primitives it depends on — citation certification and privilege-isolation attestation — are built and running today on the RankShield Network. The gateway is the integration layer being designed on top of them, and it is the part that is not yet built.
- Nothing here attests a legal conclusion. It is designed to attest architecture, isolation, and consent, exactly as the shipped capabilities already do. If we ever describe it doing more than that, hold us to this page.
- The standards are settled and public — IETF RATS, RFC 9421, FIPS 204/205, RFC 6962 — but composing them into a per-action gateway is engineering work still underway. We would rather show you the direction honestly than imply a finished feature.
- Timelines depend in part on the firms we build with. If your firm wants a say in how the gateway sits in front of your existing tools, that shapes what we build and when.
What can a firm do today while the gateway is in development?
The gateway is not shippable yet, but the ground beneath it is. A firm that wants to move now can start with the two live primitives: use citation certification so that the authorities in its filings are resolved and recorded, and use privilege-isolation attestation so that confidential material's handling is attested. Those are the same building blocks the gateway would extend to a per-action checkpoint, so adopting them now is not throwaway work — it is the on-ramp.
A firm can also become a design partner. Because the gateway is still being shaped, the firms that engage early have real influence over how it governs their specific mix of tools, how policy is expressed, and what the attested record needs to contain to satisfy their clients and their duties. If that is useful to your firm, the contact page is where that conversation starts. This is a vendor page describing a platform direction, not legal advice; how these duties apply to your matters is a judgment for your firm to make.
