ceo-orchestration 1.0.0

package/.claude/skills/domains/legal/examples/client-intake-pii-flow.md

@@ -0,0 +1,177 @@
+---
+plan_id: PLAN-EXAMPLE-LEG
+title: "AI-Assisted Client Intake — Conflict Check + Matter Opening with Privilege Controls"
+status: draft
+owner: ceo
+level: L3
+squad: legal
+profile: core,legal
+created_at: 2026-05-10
+---
+
+# Example PLAN — AI-Assisted Client Intake
+
+> **This is an illustrative example**, not a real plan. It shows how the
+> Legal squad coordinates on an AI-assisted client intake feature that
+> touches all three VETO scopes (client data/privilege, records lifecycle,
+> and billing/trust account initialization).
+>
+> Exemplar pattern derived from:
+> `.claude/skills/domains/edtech/examples/PLAN-EXAMPLE.md`
+> `.claude/skills/domains/legal/task-chains.yaml`
+
+## 1. Problem
+
+A mid-size law firm using the platform wants to accelerate client intake
+by using an AI tool to pre-screen conflict check results, classify incoming
+matter types, and draft the initial engagement letter. The intake process
+currently takes 2-3 hours of paralegal time per new matter. The AI-assisted
+workflow is projected to reduce this to 30 minutes.
+
+The challenge: the AI tool must be integrated without exposing attorney-client
+privileged content to a vendor without a qualifying DPA, and the conflict-check
+result must never expose one client's matter details to another client's
+intake context.
+
+Sources:
+- Intake form data (client name, matter description, adverse parties, jurisdiction)
+- Existing matter database (for conflict screening — adverse party index only)
+- AI tool API (for conflict pre-screening, matter classification, letter drafting)
+- Trust account system (if retainer is collected at intake)
+
+## 2. Scope
+
+**In:**
+- Conflict check (adverse party screening against closed and open matters)
+- Client PII collection and data residency assessment (GDPR/LGPD)
+- Matter record creation with append-only document store and privilege classification
+- AI-assisted engagement letter drafting (with attorney review gate before delivery)
+- Trust account initialization if retainer is collected at intake
+
+**Out:**
+- Full billing system configuration for the matter (separate matter-setup workflow)
+- E-discovery and litigation hold (separate legal-litigation-hold chain)
+- Any AI tool that receives the full matter file without DPA coverage (blocked by Ingrid VETO)
+
+## 3. Squad assignments
+
+| Phase | Owner | Deliverable |
+|---|---|---|
+| P1 — AI Tool DPA Review | Ingrid Vasquez + Chloé Bernard | DPA signed and technically verified; privilege scope document drafted (LEG-001) |
+| P2 — Conflict Check System | Amir Nakashima | CLEAR/CONFLICT-only result; no cross-matter exposure (LEG-002) |
+| P3 — PII + Residency Assessment | Ingrid Vasquez | Data residency confirmed; SCCs executed for EU/BR intake (LEG-004) |
+| P4 — Matter Record Creation | Amir Nakashima | Append-only matter record; privilege ACL; retention class assigned (LEG-005) |
+| P5 — Trust Account Init | Elena Sorokina | Three-way reconciliation baseline; retainer ledger initialized (LEG-009) |
+| P6 — Launch Review | CEO + all VETO holders | Privilege, records, billing sign-offs recorded before first live matter |
+
+## 4. Risk axes and VETO holders
+
+- **Ingrid Vasquez (Compliance Officer):** Any AI tool that ingests client matter
+  text without a DPA covering privileged content → BLOCK until DPA is signed and
+  technically verified (LEG-001). Cross-matter exposure in conflict check → BLOCK
+  immediately (LEG-002).
+- **Tobias Mensah (Records Manager):** Any matter record that does not have a
+  retention class assigned at creation → BLOCK matter from moving to active status
+  until retention class is confirmed (LEG-005).
+- **Elena Sorokina (Legal Operations Lead):** Any trust account initialization that
+  does not produce a three-way reconciliation baseline before funds are received →
+  BLOCK trust account from accepting the retainer (LEG-009).
+
+## 5. Task chains invoked
+
+- `legal-client-intake-pii-flow` — primary chain; runs the full intake workflow
+  from conflict check through matter opening and trust account initialization
+- `legal-ai-tool-onboarding` — invoked at P1 for the AI engagement-letter
+  drafting tool; runs before any client content is processed
+
+## 6. Acceptance
+
+- Conflict check returns CLEAR/CONFLICT only; underlying matter details are not
+  accessible to the intaking attorney for the conflicting matter (LEG-002)
+- DPA for the AI drafting tool explicitly covers attorney-client privileged material;
+  zero-retention claim verified technically (LEG-001)
+- EU/BR client intake confirms data residency; SCCs are executed before the first
+  data transfer to the processing stack (LEG-004)
+- Every matter record created via the intake flow has a retention class and expected
+  destruction date assigned at creation (LEG-005)
+- AI-generated engagement letter output is flagged as draft; attorney attestation
+  is required before the letter is sent to the client (LEG-012)
+- Trust account three-way reconciliation baseline is recorded before any retainer
+  funds are accepted (LEG-009)
+
+## 7. Scenario walkthrough
+
+**Scenario:** Intake coordinator Selena uses the AI-assisted intake flow for a
+new corporate client, Nexum Holdings, seeking representation on a commercial
+dispute with Apex Corp.
+
+1. **Conflict Check (P2):** The system runs the adverse party index against all
+   open and closed matters. The result returns: CONFLICT DETECTED. Selena sees
+   only "CONFLICT DETECTED — escalate to supervising attorney." She does NOT see
+   which matter or which attorney represents the conflicting party (LEG-002).
+   The supervising attorney reviews the matter-level detail in a privileged
+   view and determines it is a non-disqualifying conflict (different matter type,
+   screened attorney). Intake continues with a conflict waiver on file.
+
+2. **PII + Residency (P3):** Nexum Holdings is incorporated in the UK (post-Brexit).
+   Ingrid reviews the processing stack: the matter management system's primary
+   data center is in São Paulo. Ingrid confirms UK adequacy regulations post-Brexit
+   are in effect for this data flow and documents the assessment. If the client
+   were in the EU, UK SCCs would be required; the adequacy decision covers this case.
+
+3. **AI Tool DPA (P1):** The engagement letter drafting tool is a third-party LLM
+   API. Chloé reviews the DPA. The vendor's DPA covers attorney-client privileged
+   content but contains a vague clause about "model quality improvements." Chloé
+   escalates to Ingrid. Ingrid requires the vendor to provide a written amendment
+   confirming no training use of client matter content before the tool goes live
+   (LEG-001 triggered). The amendment is received and appended to the DPA.
+
+4. **Matter Record (P4):** Amir initializes the matter record with privilege
+   classification "attorney-client privileged" as default for all documents.
+   Tobias assigns the retention class: client file (7 years post-closure) and
+   firm work product (10 years post-closure). The expected destruction date for
+   the client file is computed from matter creation date + active period + 7 years
+   and stored in the record.
+
+5. **Trust Account (P5):** Nexum Holdings pays a $25,000 retainer. Elena initializes
+   the trust account ledger. Before the retainer is processed, the system runs a
+   three-way reconciliation baseline (matter ledger = $0, client ledger = $0, bank
+   confirmation pending). The retainer is posted only after the bank confirms receipt.
+   Elena reviews the reconciliation output — all three balances now show $25,000
+   inbound correctly (LEG-009).
+
+6. **Launch Review (P6):** CEO, Ingrid, Tobias, and Elena sign off. The AI tool
+   generates a draft engagement letter. The supervising attorney reviews, corrects
+   a clause that was subtly wrong (the AI had hallucinated a jurisdiction-specific
+   fee-disclosure requirement that does not apply here — caught at human review,
+   LEG-012), attests the letter, and sends it to Nexum Holdings.
+
+**Outcome:** The matter is opened in 35 minutes (vs. the prior 2-3 hours).
+The conflict waiver is documented, the AI tool is operating under a qualifying
+DPA, the matter record is append-only with retention class, the trust account
+is reconciled, and the engagement letter was sent only after attorney attestation.
+The AI hallucination on the fee-disclosure clause was caught before it reached
+the client.
+
+**Caveats:**
+- This example assumes the conflict waiver is straightforward. A disqualifying
+  conflict blocks the entire intake flow and does not reach steps 3-6.
+- The AI drafting tool operates only on the intake form data, not on the full
+  matter file. As the matter develops, any AI access to matter documents requires
+  re-running the legal-ai-tool-onboarding chain for the expanded scope.
+- Trust account handling for multi-currency retainers requires additional FX
+  reconciliation logic outside this squad's scope.
+
+## 8. Metrics
+
+- Intake time per new matter (target: < 45 minutes end-to-end)
+- Conflict detection accuracy (CLEAR/CONFLICT vs. manual review comparison)
+- **AI hallucination rate in engagement letters** (monitored post-launch; target < 2% requiring attorney correction)
+
+## 9. References
+
+- `.claude/skills/domains/legal/task-chains.yaml` — `legal-client-intake-pii-flow`
+- `.claude/skills/domains/legal/task-chains.yaml` — `legal-ai-tool-onboarding`
+- `.claude/skills/domains/legal/pitfalls.yaml` — LEG-001 through LEG-012
+- ADR-009 (squad-bundle completeness contract)
+- ADR-111 (PLAN-080 Phase 0a PII core promotion — inherited by legal domain)

package/.claude/skills/domains/legal/pitfalls.yaml

@@ -0,0 +1,77 @@
+# Pitfalls Catalog — Legal Squad
+# Loaded alongside the universal catalog when the legal profile is
+# installed. Format mirrors .claude/pitfalls-catalog.yaml:
+# id, rule, whenToUse, agents.
+#
+# ADR-009 §bundle-completeness: ≥10 pitfall entries required.
+# Each id follows LEG-NNN (3-digit zero-padded, monotonic).
+# Exemplars: .claude/skills/domains/edtech/pitfalls.yaml
+#            .claude/skills/domains/lgpd-heavy-saas/pitfalls.yaml
+#
+# IMPORTANT: this domain inherits PII core paths (ADR-111 / PLAN-080 Phase 0a).
+# LEG-specific pitfalls extend, not replace, the core pii-data-flow catalog.
+
+pitfalls:
+  # === ATTORNEY-CLIENT PRIVILEGE + CLIENT DATA ===
+  - id: LEG-001
+    rule: "NEVER send client matter documents, emails, or case-file content to a third-party AI/ML API without a signed DPA that explicitly covers attorney-client privileged material and confirms zero-retention at rest. Contractual 'zero retention' claims must be verified technically (no logging of inputs, no fine-tuning use)."
+    whenToUse: "any AI-assisted document review, contract analysis, legal research, or summarization feature that ingests client matter content"
+    agents: [Ingrid Vasquez, Chloé Bernard]
+
+  - id: LEG-002
+    rule: "Conflict-check queries MUST NOT expose one client's matter identifiers or adverse party names to another client's user context. The conflict-check result (CLEAR/CONFLICT) is returnable; the underlying matter details that triggered the match are NOT."
+    whenToUse: "any conflict-check feature, adverse party screening, or matter-intake workflow"
+    agents: [Ingrid Vasquez, Amir Nakashima]
+
+  - id: LEG-003
+    rule: "Client data MUST NOT be exported to non-production environments (staging, analytics, demo) without explicit anonymization sign-off from the Compliance Officer. 'Mostly anonymized' is not anonymized."
+    whenToUse: "any dev-data refresh, staging seed, analytics pipeline seeding, or demo environment provisioning"
+    agents: [Ingrid Vasquez, Tobias Mensah]
+
+  - id: LEG-004
+    rule: "Cross-border client data transfers MUST have an adequacy finding, executed SCCs, or binding corporate rules in place before the first byte leaves the jurisdiction. Check the client's governing law clause, not just the firm's home jurisdiction."
+    whenToUse: "any cloud storage, backup, or processing system that could route EU or BR client data through non-adequate jurisdictions"
+    agents: [Ingrid Vasquez]
+
+  # === RECORDS LIFECYCLE + RETENTION ===
+  - id: LEG-005
+    rule: "Matter records MUST use append-only writes for all client communications, filed documents, and work product. Overwrite operations on filed documents are forbidden — corrections create a new version with a reason code and actor ID, never a silent replacement."
+    whenToUse: "any schema design or mutation path for matter documents, filed pleadings, or client communications"
+    agents: [Tobias Mensah, Amir Nakashima]
+
+  - id: LEG-006
+    rule: "A 'delete' on matter records MUST produce a destruction certificate (record ID, destruction timestamp, actor, method, retention-class) AND trigger backup purge confirmation. A database DELETE without backup purge is not destruction under bar rules."
+    whenToUse: "any matter-closure archival, scheduled destruction workflow, or data-deletion feature"
+    agents: [Tobias Mensah]
+
+  - id: LEG-007
+    rule: "Litigation holds MUST suspend ALL destruction triggers for the affected matter — including scheduled archival jobs, backup rotation cycles, and email purge policies. A litigation hold applied only to the document folder but not to the email archive is incomplete."
+    whenToUse: "any litigation hold feature, e-discovery workflow, or matter-status adversarial flag"
+    agents: [Tobias Mensah, Amir Nakashima]
+
+  - id: LEG-008
+    rule: "New storage tiers, archival systems, or backup configurations MUST have a confirmed retention policy mapping before client data flows into them. Indefinite backup retention of archived matters violates bar-mandated destruction schedules."
+    whenToUse: "any infrastructure change involving storage, backups, CDN caching, or data archival"
+    agents: [Tobias Mensah, Ingrid Vasquez]
+
+  # === BILLING INTEGRITY + TRUST ACCOUNTS ===
+  - id: LEG-009
+    rule: "Trust account debit/credit logic MUST pass a three-way reconciliation test (matter ledger + client ledger + bank account) before any change ships. A rounding bug or off-by-one in trust account logic is a bar violation, not a UX issue."
+    whenToUse: "any change to trust account debit/credit logic, disbursement workflow, or IOLTA reconciliation feature"
+    agents: [Elena Sorokina]
+
+  - id: LEG-010
+    rule: "Time-entry rounding logic MUST be consistent across all timekeepers and timezone contexts. Timezone-dependent rounding that produces different billable minutes for the same wall-clock interval is a systematic billing error."
+    whenToUse: "any time-entry system, billing calculation, or timekeeper rounding-rule change"
+    agents: [Elena Sorokina]
+
+  - id: LEG-011
+    rule: "Write-offs and write-downs MUST produce an immutable audit trail with the authorizing attorney's ID, timestamp, reason code, and original billed amount. A write-down recorded only in a spreadsheet or email thread is not an audit trail."
+    whenToUse: "any write-off, write-down, courtesy discount, or billing adjustment feature"
+    agents: [Elena Sorokina, Ingrid Vasquez]
+
+  # === AI + LEGAL RESEARCH ACCURACY ===
+  - id: LEG-012
+    rule: "AI-generated legal research outputs (case citations, statute references, regulatory summaries) MUST be verified by a licensed attorney before they appear in any client deliverable, court filing, or legal advice document. AI hallucination of legal citations is a professional responsibility violation, not just a product bug."
+    whenToUse: "any AI-assisted legal research, brief drafting, regulatory analysis, or contract review feature that produces output shared with clients or filed in court"
+    agents: [Chloé Bernard, Ingrid Vasquez]

package/.claude/skills/domains/legal/skills/client-intake/SKILL.md

@@ -0,0 +1,407 @@
+---
+name: client-intake
+description: Legal client intake discipline for conflict-of-interest screening,
+  capacity assessment, scope-of-engagement definition, fee-agreement authoring,
+  identity verification, AML/KYC compliance, and attorney-client privilege
+  establishment. Handles full-identity PII at the contact threshold — the first
+  intake interaction simultaneously creates privilege and opens the conflict
+  database. Use when onboarding a prospective client, drafting an engagement
+  letter, running a conflict database query, assessing signatory authority,
+  structuring fee arrangements under applicable ethics rules, or evaluating
+  AML/KYC risk on a new matter. Applies across practice areas and jurisdictions;
+  calibrate conflict rules to OAB Código de Ética (Brazil) or ABA Model Rules
+  (US) per deployment context.
+owner: Alessandra Intake (Client Intake Specialist, domain persona)
+tier: domain:legal
+scope_tags: [client-intake, conflict-screening, engagement-scope, fee-agreement, kyc-aml, attorney-client-privilege]
+inherits: [core/compliance-lgpd, core/pii-data-flow, core/consent-lifecycle, core/dpo-reporting]
+pii_handling: required
+inspired_by:
+  - source: msitarzewski/agency-agents/specialized/legal-client-intake.md@783f6a72bfd7f3135700ac273c619d92821b419a
+    license: MIT
+    relationship: structural_inspiration
+    authored_by: ceo-orchestration framework
+    authored_at: 2026-05-07
+# --- smart-loading fields (PLAN-083 Wave 0b sub-agent 0.7c) ---
+domain: legal
+priority: 5
+risk_class: medium
+stack: []
+context_budget_tokens: 600
+inactive_but_retained: false
+repo_profile_binding:
+  frontend: {active: false, priority: 10}
+  engine: {active: false, priority: 10}
+  fintech: {active: true, priority: 7}
+  trading-readonly: {active: false, priority: 10}
+  generic: {active: false, priority: 10}
+activation_triggers: []
+# --- K1 paths: native file-touch activation (PLAN-135 W3 unit k1a) ---
+paths:
+  - "**/intake/**"
+  - "**/conflicts/**"
+  - "**/engagements/**"
+  - "**/kyc/**"
+---
+
+# Legal Client Intake
+
+First contact with a prospective client opens attorney-client privilege,
+creates conflict obligations, and triggers AML/KYC duties — simultaneously.
+All three regimes attach before substantive representation begins. This
+skill codifies the doctrine that turns an intake call into a legally
+sound engagement: structured conflict query, verified authority, written
+scope, compliant fee terms, and privilege-anchored communication channels.
+
+## Cardinal Rule
+
+**No substantive legal advice is provided, no consultation is scheduled,
+and no fee is collected until the conflict database query returns
+CLEARED.** A single missed conflict can trigger disqualification,
+malpractice liability, and disciplinary proceedings under OAB Cód. Ética
+Art. 15 or ABA Model Rule 1.7. The conflict check is not a courtesy — it
+is a structural gate that all other intake steps depend on.
+
+## Fail-Fast Rule
+
+Halt intake and escalate to the supervising attorney immediately if ANY
+of the following conditions are true:
+
+1. Prospective client cannot produce government-issued photo ID within
+   the required verification window.
+2. PEP screening or sanctions check returns a positive match against OFAC
+   SDN, UN Consolidated List, or applicable national list.
+3. Conflict database query returns CONFLICT or POTENTIAL-CONFLICT without
+   a written waiver signed by all affected current clients.
+4. Signatory presents without verified authority (unsigned board
+   resolution, expired POA, contested estate administrator appointment).
+5. Matter description triggers a mandatory SAR filing threshold under
+   applicable AML rules before the engagement can lawfully proceed.
+
+In each case, document the halt reason in the intake record and do not
+generate an engagement letter.
+
+## When to Apply
+
+Apply this skill at the intake threshold — the first structured contact
+at which a prospective client discloses matter facts. Scope includes:
+
+- Initial consultation qualification calls and web-form intakes
+- Conflict database queries triggered by a new matter or new adverse party
+- Engagement letter drafting and fee agreement authoring
+- KYC/AML risk-rating and PEP/sanctions screening for new matters
+- Capacity and authority verification for individual and entity clients
+- Re-engagement of former clients on a new matter (new conflict query
+  required even if the client previously cleared)
+
+Do not apply for internal administrative tasks that carry no client PII
+and no conflict exposure.
+
+## PII Handling
+
+Client intake collects the highest-density PII in the legal engagement
+lifecycle. All intake operations must observe the following controls:
+
+**Collected categories and minimization rule:**
+- Full legal name, aliases, government-issued ID number, date of birth
+  (identity verification; collect only what the jurisdiction's KYC regime
+  requires — do not collect passport and national ID simultaneously unless
+  the matter risk-rating requires dual-document verification)
+- Contact address, phone, email (communication channel discipline — see
+  Attorney-Client Privilege Establishment)
+- Financial information: source-of-funds declaration, beneficial-ownership
+  chain for entities, trust deposit details (collect only for matters
+  where fee structure or AML rules require it)
+- Matter facts: incident dates, transaction amounts, adverse party
+  identities, prior legal action records (collect only what is necessary
+  to complete the conflict query and draft the engagement scope)
+- Adverse party information: names, entity identifiers, counsel if known
+  (required for conflict query; do not collect financial or personal data
+  about adverse parties beyond what the conflict query demands)
+
+**Transmission:** intake forms must use encrypted channels (TLS 1.2+);
+verbal intake via phone must be recorded only with explicit consent per
+applicable wiretap law; email intake must warn the prospective client
+that unencrypted email is not a privileged channel until an engagement
+letter is signed.
+
+**Retention:** matter file is retained per the firm's retention schedule
+anchored to the applicable limitation period for the practice area plus a
+minimum seven-year floor. For declined or referred matters, retain only
+the conflict record (party names, matter type, declination date) and
+destroy substantive intake notes per the destruction schedule. Document
+the destruction.
+
+**Deletion on declination:** when the firm declines representation, purge
+all PII beyond the conflict record within 30 days of the declination
+letter. Log the purge in the intake audit trail.
+
+**Cross-border note:** if the prospective client is located in Brazil or
+the matter involves Brazilian data subjects, `core/compliance-lgpd`
+governs PII processing on top of this skill. Document the LGPD legal
+basis for intake data collection (typically Art. 7, VI — legitimate
+interest in assessing the professional relationship) in the data
+processing registry before the first intake session.
+
+## Conflict Screening
+
+Conflict screening must run against the firm's conflict database BEFORE
+any consultation is scheduled and BEFORE any substantive matter facts
+are disclosed to an attorney.
+
+**Query inputs (collect before running query):**
+- Prospective client: full legal name + all known aliases + entity name
+  and jurisdiction if corporate
+- Matter type and opposing party: full legal name of every adverse party
+  identified so far (the query runs again if new adverse parties emerge
+  mid-representation)
+- Prior relationship: whether the prospective client or any disclosed
+  adverse party has previously retained the firm in any capacity
+
+**Conflict categories:**
+
+| Category | Trigger | Disposition |
+|---|---|---|
+| Direct conflict | Firm currently represents an adverse party in this or a substantially related matter | BLOCK — cannot accept without withdrawal + all-party waiver |
+| Former-client conflict | Firm previously represented an adverse party in a substantially related matter | BLOCK unless waiver obtained per ABA MR 1.9 / OAB Art. 18 |
+| Positional conflict | Firm argues legally inconsistent positions in simultaneous matters | Escalate to supervising partner for authorization |
+| Advance waiver | Written, informed waiver signed before representation begins | CLEARED with waiver on file |
+| No conflict | No database match on any party | CLEARED — document query timestamp |
+
+**OAB Cód. Ética anchor (Brazil):** Arts. 15, 16, and 18 govern conflict
+obligations. Art. 15 prohibits representing parties with opposing
+interests in the same proceeding. Art. 18 restricts former-client matters
+using confidential information. Advance waivers are permitted only where
+both parties give informed, written consent after full disclosure.
+
+**ABA Model Rules anchor (US):** Rules 1.7 (concurrent), 1.9
+(former-client), and 1.10 (imputation within a firm). Consult applicable
+state court's professional conduct rules for jurisdiction-specific
+deviations.
+
+**Running the query:** submit query to conflict database with all party
+names before any consultation is booked. Document: query timestamp,
+parties queried, result (CLEARED / CONFLICT / POTENTIAL-CONFLICT /
+PENDING), and reviewer sign-off. Never move to the next intake step
+until CLEARED appears in the record.
+
+## Capacity Assessment
+
+Verified capacity and authority to retain counsel is a prerequisite for
+a binding engagement agreement.
+
+**Individual clients:**
+- Decisional capacity: the prospective client must understand the nature
+  of legal representation, the scope of the matter, and the fee
+  obligation. If capacity is in doubt (cognitive impairment, acute crisis,
+  intoxication), pause intake and schedule a follow-up; do not proceed on
+  a telephone intake alone.
+- Minor representation: a minor cannot execute an engagement letter.
+  Identify the legal guardian, verify guardianship documentation, and
+  confirm the guardian's authority extends to legal proceedings on the
+  minor's behalf.
+- Guardianship / conservatorship: verify the court order appointing the
+  guardian and confirm it has not been superseded or challenged.
+
+**Entity clients:**
+- Corporate authority: obtain board resolution or written authorization
+  from the corporate secretary confirming the signatory has authority to
+  bind the entity to legal representation and fee obligations.
+- Partnership authority: verify the partnership agreement grants the
+  signing partner authority to retain outside counsel.
+- Trust: obtain the trust instrument and verify trustee authority to
+  engage counsel on trust matters; confirm the trust is not under active
+  court supervision that limits trustee authority.
+- Insolvency and restructuring: if the entity is in bankruptcy,
+  receivership, or under an administrator's control, verify that the
+  trustee, receiver, or administrator (not former management) is the
+  authorized principal. Former management has no authority to retain
+  counsel on behalf of the estate without court approval.
+
+Document the authority verification in the intake record with copies of
+the authorizing instrument retained in the matter file.
+
+## Scope of Engagement
+
+The engagement scope is the written boundary of the attorney-client
+relationship. Scope ambiguity is the primary driver of fee disputes and
+malpractice claims.
+
+**Scope decision matrix:**
+
+| Representation type | Use when |
+|---|---|
+| Full representation | Client retains counsel for all aspects of the matter through resolution |
+| Limited scope (unbundled) | Client retains counsel for a defined discrete task (e.g., contract review only; single hearing appearance) — disclose limitations and confirm client understands attorney will not monitor related issues |
+| Advisory only | Counsel provides legal analysis without appearing or filing — no attorney of record status |
+
+**Scope document requirements:**
+1. Identify the specific legal matter (proceeding, transaction, or
+   advisory question) with enough specificity that a future court or
+   disciplinary tribunal can determine what was and was not covered.
+2. Carve out explicitly any related or adjacent matters the firm is NOT
+   handling (e.g., "This engagement covers the commercial lease dispute
+   at [address] only; related employment claims are outside scope").
+3. State the geographic and jurisdictional limits of the representation.
+4. State the temporal scope: does the engagement terminate on a specific
+   event (e.g., execution of settlement agreement), or does it require a
+   written termination notice?
+5. For limited-scope representations, include an explicit unbundled-
+   services disclosure per applicable jurisdiction ethics rules.
+
+**Scope expansion:** any expansion of scope beyond the original
+engagement letter requires a written amendment signed by the client
+before the additional work begins. Verbal scope expansion is not binding
+and exposes the firm to unpaid fee disputes.
+
+## Fee Agreement
+
+Fee agreements are required to be in writing in most jurisdictions before
+work commences. Oral fee agreements are an anti-pattern (see
+Anti-Patterns table).
+
+**Fee structures:**
+
+| Structure | When appropriate | Ethics anchors |
+|---|---|---|
+| Hourly | Complex litigation, corporate transactional work, advisory mandates | Billing rate, time-keeping increment, and billing frequency must be stated; OAB Art. 35 / ABA MR 1.5(a) reasonableness standard applies |
+| Contingency | Personal injury, consumer protection, select employment matters | Percentage must be stated for pre-settlement, post-settlement, and post-trial outcomes separately; prohibited in criminal defense and domestic relations in most jurisdictions per ABA MR 1.5(d) |
+| Flat fee | Document drafting, will preparation, trademark registration, routine immigration petitions | Specify whether flat fee is earned-on-receipt or refundable pro-rata; billing disputes hinge on this distinction |
+| Hybrid | Complex litigation with unpredictable resolution path | Document the split clearly (e.g., reduced hourly + 15% contingency on recovery above threshold) |
+
+**Trust deposit (IOLTA / client account):**
+- State the deposit amount required before work commences.
+- Confirm the deposit is held in a jurisdiction-compliant client trust
+  account (IOLTA in the US; OAB trust account rules in Brazil).
+- State the draw-down frequency and the obligation to provide a
+  contemporaneous billing statement on each draw.
+- Replenishment threshold: state the balance below which the client must
+  replenish the deposit to avoid suspension of representation.
+
+**Jurisdictional compliance:**
+- Brazil: OAB Tabela de Honorários provides minimum fee guidance per
+  practice area and procedural act; below-table fees must be justified
+  and documented.
+- US: ABA Model Rule 1.5 governs reasonableness; check state rules for
+  mandatory fee agreement writing requirements (California, Texas, and
+  others impose statutory requirements for written agreements in specific
+  matter types).
+
+## Identity and AML/KYC
+
+Identity verification and AML/KYC screening apply at the engagement
+opening, regardless of matter type, in regulated legal-services
+jurisdictions. Even in non-regulated jurisdictions, AML risk awareness
+is professional-responsibility best practice for matters involving
+significant asset transfers.
+
+**Identity verification steps:**
+1. Collect government-issued photo ID (passport, national identity card,
+   or equivalent); for entities, collect certificate of incorporation,
+   current registered-office confirmation, and beneficial-ownership
+   declaration.
+2. Verify the ID is current and not expired.
+3. For remote intake, use a compliant video-ID or e-KYC service that
+   produces an audit trail; do not accept unwitnessed self-certified
+   scans as sole verification on high-risk matters.
+
+**PEP screening:** query the prospective client and all disclosed
+beneficial owners against:
+- OFAC SDN List (US nexus matters)
+- UN Security Council Consolidated List (universal)
+- EU Consolidated Financial Sanctions List (EU nexus)
+- Brazilian COAF / Receita Federal watchlists (Brazil nexus)
+
+A PEP match does not automatically block engagement but triggers enhanced
+due diligence: document source of funds, beneficial-ownership chain to
+the natural person level, and obtain partner-level sign-off before
+accepting the engagement.
+
+**FATF risk-rating:** assign a risk rating (Low / Medium / High) per the
+FATF risk-based approach:
+
+| Factor | Elevated risk indicators |
+|---|---|
+| Client type | PEP, shell company, bearer-share entity, cash-intensive business |
+| Matter type | Real estate purchase, M&A, trust formation, cross-border asset transfer |
+| Geography | High-risk or high-secrecy jurisdiction per FATF / BCBS greylist |
+| Transaction size | Above AML reporting threshold for the jurisdiction |
+
+**SAR triggers:** file a Suspicious Activity Report (FinCEN in the US /
+COAF in Brazil) if the matter facts, after engagement, reveal reasonable
+grounds to suspect money laundering or terrorist financing. Legal
+privilege does not shield the attorney from SAR filing obligations where
+applicable law requires disclosure. Document the tipping-off prohibition:
+the client must not be notified that a SAR has been filed.
+
+## Attorney-Client Privilege Establishment
+
+The engagement letter is the privilege anchor. Privilege attaches to
+communications made in confidence for the purpose of seeking legal
+advice. The intake process must establish the channel discipline before
+the first privileged communication occurs.
+
+**Engagement letter as privilege anchor:**
+- Sign and date the engagement letter before discussing substantive
+  matter strategy or legal analysis.
+- The letter must identify the attorney-client relationship, confirm
+  confidentiality, and state the scope of representation.
+- For prospective clients who are not yet retained, intake communications
+  are protected as prospective-client communications under ABA MR 1.18 /
+  OAB Art. 7, §2; document this status explicitly in the intake record.
+
+**Communication channel discipline:**
+- Designate a specific channel for privileged communications (firm email
+  domain, secure client portal, or encrypted messaging service).
+- Warn the client in the engagement letter that communications via
+  personal, unencrypted email or social media may not be protected.
+- Document the agreed channel in the intake record; flag any future
+  communications received outside the agreed channel for client
+  notification.
+
+**Privileged vs. non-privileged classification:**
+
+| Communication type | Privileged |
+|---|---|
+| Client describes facts to attorney for legal advice | Yes |
+| Attorney's legal analysis and recommendations | Yes |
+| Underlying business documents attached to privileged email | No (document itself is not privileged merely by transmission to attorney) |
+| Intake intake forms submitted before engagement letter | Protected as prospective-client communication |
+| Communications forwarded to non-attorney third parties | Waiver risk — advise client before forwarding |
+| Communications in furtherance of a crime or fraud | Not privileged — crime-fraud exception |
+
+**Work-product doctrine:** distinguish attorney-client privilege
+(protects confidential client communications) from work-product doctrine
+(protects attorney mental impressions and litigation preparation). Both
+protections must be invoked separately and logged when privilege is
+asserted in discovery.
+
+## Anti-Patterns
+
+| Anti-pattern | Risk | Correct practice |
+|---|---|---|
+| Scheduling consultation before conflict check completes | Disqualification; malpractice; disciplinary proceedings | Run conflict query on all party names before any appointment is booked |
+| Oral fee agreement only | Unpaid fee disputes; billing complaints; ethics violation in jurisdictions requiring written agreements | Execute signed written fee agreement before work commences |
+| Scope creep without written amendment | Client disputes additional fees; malpractice for work outside scope | Draft and sign scope amendment before beginning additional work |
+| Ignored capacity flags | Voidable engagement agreement; guardianship dispute; malpractice | Pause intake; verify capacity with supervising attorney; document resolution |
+| Collecting PII beyond KYC minimization | LGPD / GDPR violation; data subject complaints; regulatory fine | Collect only the identity fields the jurisdiction's KYC regime requires for the matter risk level |
+| SAR filed without tipping-off analysis | Criminal liability for the attorney if client is notified | File SAR; review tipping-off prohibition before any client communication post-filing |
+| Engagement letter without channel designation | Privilege waiver risk for out-of-channel communications | State the designated privileged channel in the engagement letter |
+| Re-engaging former client without new conflict query | Former-client conflict under ABA MR 1.9 / OAB Art. 18 missed | Run full conflict query on new matter and new adverse parties; prior CLEARED status does not carry forward |
+
+## Cross-References
+
+- `core/compliance-lgpd` — LGPD legal basis for intake PII processing,
+  data subject rights obligations, and breach notification if intake
+  records are exposed
+- `domains/legal/skills/document-review` — privilege log preparation
+  and document-by-document privilege classification during discovery
+- `domains/legal/skills/legal-billing` — billing statement format,
+  trust account draw-down procedures, and IOLTA reconciliation
+
+## ADR Anchors
+
+- **ADR-058** — two-pass adversarial review doctrine: all intake
+  deliverables (engagement letters, fee agreements, conflict reports)
+  undergo a second-pass review by a supervising attorney before execution;
+  intake specialist output is a draft, not a final instrument