thumbgate 1.23.0 → 1.23.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +5 -5
- package/.claude-plugin/plugin.json +2 -2
- package/.well-known/llms.txt +26 -11
- package/.well-known/mcp/server-card.json +8 -8
- package/README.md +69 -34
- package/adapters/claude/.mcp.json +2 -2
- package/adapters/mcp/server-stdio.js +1 -1
- package/adapters/opencode/opencode.json +1 -1
- package/bin/cli.js +57 -16
- package/bin/postinstall.js +11 -22
- package/config/gate-templates.json +72 -0
- package/config/github-about.json +1 -1
- package/config/post-deploy-marketing-pages.json +10 -0
- package/package.json +6 -6
- package/public/agent-manager.html +3 -3
- package/public/agents-cost-savings.html +3 -3
- package/public/ai-malpractice-prevention.html +726 -149
- package/public/blog.html +3 -3
- package/public/codex-enterprise.html +3 -3
- package/public/codex-plugin.html +4 -4
- package/public/compare.html +6 -6
- package/public/dashboard.html +211 -126
- package/public/guide.html +5 -5
- package/public/index.html +187 -47
- package/public/learn.html +24 -10
- package/public/lessons.html +2 -2
- package/public/numbers.html +6 -6
- package/public/pricing.html +6 -5
- package/public/pro.html +23 -0
- package/scripts/billing.js +17 -0
- package/scripts/commercial-offer.js +75 -0
- package/scripts/dashboard.js +53 -1
- package/scripts/gates-engine.js +3 -3
- package/scripts/plausible-server-events.js +2 -1
- package/scripts/rate-limiter.js +16 -12
- package/scripts/seo-gsd.js +167 -1
- package/scripts/telemetry-analytics.js +310 -0
- package/scripts/visitor-journey.js +172 -0
- package/src/api/server.js +65 -29
- package/adapters/chatgpt/openapi.yaml +0 -1705
|
@@ -3,181 +3,758 @@
|
|
|
3
3
|
<head>
|
|
4
4
|
<meta charset="UTF-8">
|
|
5
5
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
6
|
-
<title>
|
|
6
|
+
<title>Pre-Execution Controls for Legal AI Agents - ThumbGate</title>
|
|
7
7
|
<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
|
|
8
|
-
<meta name="description" content="
|
|
9
|
-
<meta property="og:title" content="
|
|
10
|
-
<meta property="og:description" content="
|
|
8
|
+
<meta name="description" content="Pre-execution controls for law-firm AI agents: block unauthorized advice, conflict-check failures, privilege leaks, and unapproved model calls before an agent acts.">
|
|
9
|
+
<meta property="og:title" content="Pre-Execution Controls for Legal AI Agents">
|
|
10
|
+
<meta property="og:description" content="ThumbGate preloads firm-approved ground truth, checks legal AI actions before execution, and records audit evidence for law-firm innovation, risk, and pricing teams.">
|
|
11
11
|
<meta property="og:type" content="article">
|
|
12
|
-
<meta property="og:image" content="https://thumbgate
|
|
13
|
-
<link rel="canonical" href="https://thumbgate
|
|
12
|
+
<meta property="og:image" content="https://thumbgate.ai/og.png">
|
|
13
|
+
<link rel="canonical" href="https://thumbgate.ai/ai-malpractice-prevention">
|
|
14
14
|
<script type="application/ld+json">
|
|
15
15
|
{
|
|
16
16
|
"@context": "https://schema.org",
|
|
17
17
|
"@type": "TechArticle",
|
|
18
|
-
"headline": "
|
|
19
|
-
"description": "ThumbGate is a
|
|
18
|
+
"headline": "Pre-Execution Controls for Legal AI Agents",
|
|
19
|
+
"description": "ThumbGate is a pre-execution control layer for law-firm AI intake workflows. It can preload firm-approved ground truth, evaluate proposed agent actions before execution, and produce audit evidence for human review.",
|
|
20
20
|
"datePublished": "2026-05-21",
|
|
21
|
-
"dateModified": "2026-05-
|
|
21
|
+
"dateModified": "2026-05-25",
|
|
22
22
|
"author": { "@type": "Person", "name": "Igor Ganapolsky", "url": "https://github.com/IgorGanapolsky" },
|
|
23
|
-
"publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate
|
|
23
|
+
"publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
|
|
24
24
|
"about": [
|
|
25
|
-
{ "@type": "Thing", "name": "Legal AI" },
|
|
25
|
+
{ "@type": "Thing", "name": "Legal AI Governance" },
|
|
26
26
|
{ "@type": "Thing", "name": "Unauthorized Practice of Law" },
|
|
27
27
|
{ "@type": "Thing", "name": "Attorney-Client Privilege" },
|
|
28
|
-
{ "@type": "Thing", "name": "ABA
|
|
28
|
+
{ "@type": "Thing", "name": "ABA Formal Opinion 512" },
|
|
29
29
|
{ "@type": "Thing", "name": "Conflict of Interest Check" }
|
|
30
30
|
]
|
|
31
31
|
}
|
|
32
32
|
</script>
|
|
33
33
|
<style>
|
|
34
|
-
*, *::before, *::after {
|
|
35
|
-
:root {
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
34
|
+
*, *::before, *::after { box-sizing: border-box; }
|
|
35
|
+
:root {
|
|
36
|
+
--bg: #08090b;
|
|
37
|
+
--panel: #14161a;
|
|
38
|
+
--panel-2: #1b1f26;
|
|
39
|
+
--line: #2c313a;
|
|
40
|
+
--text: #f2f4f8;
|
|
41
|
+
--muted: #a7afbd;
|
|
42
|
+
--soft: #d8deea;
|
|
43
|
+
--blue: #62a4ff;
|
|
44
|
+
--cyan: #2dd4bf;
|
|
45
|
+
--amber: #f2bd5b;
|
|
46
|
+
--red: #fb7185;
|
|
47
|
+
--green: #72e3a5;
|
|
48
|
+
}
|
|
49
|
+
body {
|
|
50
|
+
margin: 0;
|
|
51
|
+
font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
|
|
52
|
+
background: var(--bg);
|
|
53
|
+
color: var(--text);
|
|
54
|
+
line-height: 1.58;
|
|
55
|
+
}
|
|
56
|
+
a { color: var(--blue); }
|
|
57
|
+
nav {
|
|
58
|
+
display: flex;
|
|
59
|
+
align-items: center;
|
|
60
|
+
gap: 1.1rem;
|
|
61
|
+
flex-wrap: wrap;
|
|
62
|
+
padding: 0.9rem clamp(1rem, 3vw, 2.25rem);
|
|
63
|
+
border-bottom: 1px solid var(--line);
|
|
64
|
+
background: rgba(8, 9, 11, 0.94);
|
|
65
|
+
position: sticky;
|
|
66
|
+
top: 0;
|
|
67
|
+
z-index: 10;
|
|
68
|
+
}
|
|
69
|
+
nav a { color: var(--muted); text-decoration: none; font-size: 0.9rem; }
|
|
70
|
+
nav .brand { color: var(--text); font-weight: 850; }
|
|
71
|
+
.wrap { max-width: 1120px; margin: 0 auto; padding: 0 clamp(1rem, 3vw, 2rem); }
|
|
72
|
+
.hero {
|
|
73
|
+
min-height: calc(100vh - 68px);
|
|
74
|
+
display: grid;
|
|
75
|
+
grid-template-columns: minmax(0, 1fr) minmax(320px, 0.9fr);
|
|
76
|
+
gap: clamp(2rem, 5vw, 4rem);
|
|
77
|
+
align-items: center;
|
|
78
|
+
padding: clamp(3rem, 6vw, 5rem) 0 2.2rem;
|
|
79
|
+
}
|
|
80
|
+
.eyebrow {
|
|
81
|
+
display: inline-flex;
|
|
82
|
+
color: var(--cyan);
|
|
83
|
+
border: 1px solid rgba(45, 212, 191, 0.24);
|
|
84
|
+
background: rgba(45, 212, 191, 0.08);
|
|
85
|
+
padding: 0.34rem 0.72rem;
|
|
86
|
+
border-radius: 999px;
|
|
87
|
+
font-size: 0.76rem;
|
|
88
|
+
font-weight: 850;
|
|
89
|
+
letter-spacing: 0.08em;
|
|
90
|
+
text-transform: uppercase;
|
|
91
|
+
}
|
|
92
|
+
h1 {
|
|
93
|
+
font-size: clamp(2.25rem, 4.1vw, 3.65rem);
|
|
94
|
+
line-height: 1.03;
|
|
95
|
+
letter-spacing: 0;
|
|
96
|
+
margin: 1.1rem 0 1rem;
|
|
97
|
+
max-width: 800px;
|
|
98
|
+
}
|
|
99
|
+
.lead {
|
|
100
|
+
color: var(--soft);
|
|
101
|
+
font-size: clamp(1.05rem, 1.65vw, 1.24rem);
|
|
102
|
+
max-width: 760px;
|
|
103
|
+
margin: 0 0 1.4rem;
|
|
104
|
+
}
|
|
105
|
+
.hero-actions { display: flex; align-items: center; gap: 1rem; flex-wrap: wrap; margin: 1.4rem 0; }
|
|
106
|
+
.cta {
|
|
107
|
+
display: inline-flex;
|
|
108
|
+
align-items: center;
|
|
109
|
+
justify-content: center;
|
|
110
|
+
min-height: 48px;
|
|
111
|
+
padding: 0.78rem 1.05rem;
|
|
112
|
+
border-radius: 8px;
|
|
113
|
+
background: var(--blue);
|
|
114
|
+
color: #06111f;
|
|
115
|
+
text-decoration: none;
|
|
116
|
+
font-weight: 850;
|
|
117
|
+
}
|
|
118
|
+
.ghost { color: var(--soft); text-decoration: none; border-bottom: 1px solid var(--line); padding-bottom: 0.1rem; }
|
|
119
|
+
.proof-row {
|
|
120
|
+
display: grid;
|
|
121
|
+
grid-template-columns: repeat(3, minmax(0, 1fr));
|
|
122
|
+
gap: 0.75rem;
|
|
123
|
+
margin-top: 1.2rem;
|
|
124
|
+
max-width: 820px;
|
|
125
|
+
}
|
|
126
|
+
.proof {
|
|
127
|
+
border: 1px solid var(--line);
|
|
128
|
+
border-radius: 8px;
|
|
129
|
+
padding: 0.82rem;
|
|
130
|
+
background: rgba(255, 255, 255, 0.03);
|
|
131
|
+
min-height: 92px;
|
|
132
|
+
}
|
|
133
|
+
.proof strong { display: block; color: var(--text); font-size: 0.94rem; }
|
|
134
|
+
.proof span { color: var(--muted); font-size: 0.85rem; }
|
|
135
|
+
.trust-strip {
|
|
136
|
+
display: grid;
|
|
137
|
+
grid-template-columns: repeat(4, minmax(0, 1fr));
|
|
138
|
+
gap: 0.7rem;
|
|
139
|
+
margin: 1.2rem 0 0;
|
|
140
|
+
max-width: 920px;
|
|
141
|
+
}
|
|
142
|
+
.trust-item {
|
|
143
|
+
border: 1px solid rgba(98, 164, 255, 0.24);
|
|
144
|
+
border-radius: 8px;
|
|
145
|
+
background: rgba(98, 164, 255, 0.07);
|
|
146
|
+
padding: 0.72rem;
|
|
147
|
+
color: var(--soft);
|
|
148
|
+
font-size: 0.82rem;
|
|
149
|
+
font-weight: 750;
|
|
150
|
+
}
|
|
151
|
+
.control-flow {
|
|
152
|
+
border: 1px solid #343a46;
|
|
153
|
+
background: #101318;
|
|
154
|
+
border-radius: 8px;
|
|
155
|
+
box-shadow: 0 24px 80px rgba(0, 0, 0, 0.34);
|
|
156
|
+
padding: 1rem;
|
|
157
|
+
}
|
|
158
|
+
.flow-asset {
|
|
159
|
+
display: block;
|
|
160
|
+
width: 100%;
|
|
161
|
+
height: auto;
|
|
162
|
+
border: 1px solid var(--line);
|
|
163
|
+
border-radius: 8px;
|
|
164
|
+
margin: 0 0 0.9rem;
|
|
165
|
+
background: #08090b;
|
|
166
|
+
}
|
|
167
|
+
.control-flow h2 { font-size: 1rem; margin: 0 0 0.85rem; color: var(--soft); }
|
|
168
|
+
.flow-step {
|
|
169
|
+
display: grid;
|
|
170
|
+
grid-template-columns: 34px minmax(0, 1fr);
|
|
171
|
+
gap: 0.8rem;
|
|
172
|
+
align-items: start;
|
|
173
|
+
border: 1px solid var(--line);
|
|
174
|
+
border-radius: 8px;
|
|
175
|
+
background: var(--panel);
|
|
176
|
+
padding: 0.88rem;
|
|
177
|
+
margin: 0.72rem 0;
|
|
178
|
+
}
|
|
179
|
+
.num {
|
|
180
|
+
width: 34px;
|
|
181
|
+
height: 34px;
|
|
182
|
+
display: grid;
|
|
183
|
+
place-items: center;
|
|
184
|
+
border-radius: 8px;
|
|
185
|
+
font-weight: 850;
|
|
186
|
+
color: #06111f;
|
|
187
|
+
background: var(--cyan);
|
|
188
|
+
}
|
|
189
|
+
.flow-step h3 { margin: 0 0 0.24rem; font-size: 0.98rem; }
|
|
190
|
+
.flow-step p { margin: 0; color: var(--muted); font-size: 0.9rem; }
|
|
191
|
+
.blocked { border-color: rgba(251, 113, 133, 0.55); background: rgba(251, 113, 133, 0.08); }
|
|
192
|
+
.blocked .num { background: var(--red); color: #19070a; }
|
|
193
|
+
.cleared { border-color: rgba(114, 227, 165, 0.42); background: rgba(114, 227, 165, 0.08); }
|
|
194
|
+
.cleared .num { background: var(--green); color: #06120b; }
|
|
195
|
+
main section {
|
|
196
|
+
border-top: 1px solid var(--line);
|
|
197
|
+
padding: clamp(2.35rem, 5vw, 4rem) 0;
|
|
198
|
+
}
|
|
199
|
+
h2 {
|
|
200
|
+
font-size: clamp(1.75rem, 2.8vw, 2.5rem);
|
|
201
|
+
line-height: 1.15;
|
|
202
|
+
margin: 0 0 0.75rem;
|
|
203
|
+
letter-spacing: 0;
|
|
204
|
+
}
|
|
205
|
+
.section-lead { color: var(--muted); font-size: 1.05rem; max-width: 820px; margin: 0 0 1.35rem; }
|
|
206
|
+
.grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 1rem; }
|
|
207
|
+
.two { grid-template-columns: repeat(2, minmax(0, 1fr)); }
|
|
208
|
+
.card {
|
|
209
|
+
border: 1px solid var(--line);
|
|
210
|
+
background: var(--panel);
|
|
211
|
+
border-radius: 8px;
|
|
212
|
+
padding: 1rem;
|
|
213
|
+
}
|
|
214
|
+
.card h3 { margin: 0 0 0.5rem; font-size: 1.04rem; color: var(--text); }
|
|
215
|
+
.card p, .card li { color: var(--muted); margin: 0.42rem 0; }
|
|
216
|
+
.tag {
|
|
217
|
+
display: inline-flex;
|
|
218
|
+
color: #071116;
|
|
219
|
+
background: var(--cyan);
|
|
220
|
+
border-radius: 6px;
|
|
221
|
+
padding: 0.14rem 0.45rem;
|
|
222
|
+
font-size: 0.72rem;
|
|
223
|
+
font-weight: 850;
|
|
224
|
+
margin-bottom: 0.62rem;
|
|
225
|
+
}
|
|
226
|
+
.amber { background: var(--amber); }
|
|
227
|
+
.red { background: var(--red); color: #19070a; }
|
|
228
|
+
.blue { background: var(--blue); color: #06111f; }
|
|
229
|
+
.green { background: var(--green); color: #06120b; }
|
|
230
|
+
.matrix { width: 100%; border-collapse: collapse; border: 1px solid var(--line); border-radius: 8px; overflow: hidden; }
|
|
231
|
+
.matrix th, .matrix td {
|
|
232
|
+
padding: 0.82rem;
|
|
233
|
+
border-bottom: 1px solid var(--line);
|
|
234
|
+
vertical-align: top;
|
|
235
|
+
text-align: left;
|
|
236
|
+
}
|
|
237
|
+
.matrix th { color: var(--cyan); background: #11151b; font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; }
|
|
238
|
+
.matrix td { color: var(--muted); }
|
|
239
|
+
.callout {
|
|
240
|
+
background: #f2f4f8;
|
|
241
|
+
color: #111827;
|
|
242
|
+
border-radius: 8px;
|
|
243
|
+
padding: clamp(1.2rem, 3vw, 1.8rem);
|
|
244
|
+
}
|
|
245
|
+
.callout p, .callout li { color: #344054; }
|
|
246
|
+
.callout .cta { background: #111827; color: #fff; }
|
|
247
|
+
.footer {
|
|
248
|
+
color: var(--muted);
|
|
249
|
+
padding: 2.2rem 0 4rem;
|
|
250
|
+
border-top: 1px solid var(--line);
|
|
251
|
+
}
|
|
252
|
+
@media (max-width: 880px) {
|
|
253
|
+
.hero, .grid, .two, .proof-row, .trust-strip { grid-template-columns: 1fr; }
|
|
254
|
+
.hero { min-height: auto; padding-top: 2.4rem; }
|
|
255
|
+
nav { position: static; }
|
|
256
|
+
}
|
|
257
|
+
@media (max-width: 700px) {
|
|
258
|
+
.matrix, .matrix tbody, .matrix tr, .matrix td { display: block; width: 100%; }
|
|
259
|
+
.matrix { border: 0; }
|
|
260
|
+
.matrix thead { display: none; }
|
|
261
|
+
.matrix tr {
|
|
262
|
+
border: 1px solid var(--line);
|
|
263
|
+
border-radius: 8px;
|
|
264
|
+
margin-bottom: 0.85rem;
|
|
265
|
+
background: var(--panel);
|
|
266
|
+
overflow: hidden;
|
|
267
|
+
}
|
|
268
|
+
.matrix td { border-bottom: 1px solid var(--line); padding: 0.75rem 0.9rem; }
|
|
269
|
+
.matrix td:last-child { border-bottom: 0; }
|
|
270
|
+
.matrix td::before {
|
|
271
|
+
display: block;
|
|
272
|
+
color: var(--cyan);
|
|
273
|
+
font-size: 0.72rem;
|
|
274
|
+
font-weight: 850;
|
|
275
|
+
letter-spacing: 0.06em;
|
|
276
|
+
margin-bottom: 0.25rem;
|
|
277
|
+
text-transform: uppercase;
|
|
278
|
+
}
|
|
279
|
+
.matrix td:nth-child(1)::before { content: "Buyer question"; }
|
|
280
|
+
.matrix td:nth-child(2)::before { content: "Pilot answer"; }
|
|
281
|
+
.matrix td:nth-child(3)::before { content: "Evidence to bring"; }
|
|
282
|
+
}
|
|
283
|
+
.demo-result { margin-top:1rem; padding:1rem; border-radius:8px; font-size:0.95rem; }
|
|
284
|
+
.demo-blocked { background:rgba(248,113,113,0.1); border:1px solid var(--red); }
|
|
285
|
+
.demo-cleared { background:rgba(52,211,153,0.1); border:1px solid var(--green); }
|
|
286
|
+
.audit-log { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size:0.85rem; background:#0f0f11; padding:0.75rem; border-radius:6px; margin-top:0.75rem; white-space:pre-wrap; color:var(--soft); }
|
|
64
287
|
</style>
|
|
65
288
|
</head>
|
|
66
289
|
<body>
|
|
67
290
|
<nav>
|
|
68
|
-
<a href="/" class="brand">ThumbGate</a>
|
|
291
|
+
<a href="/ai-malpractice-prevention" class="brand">ThumbGate</a>
|
|
69
292
|
<a href="/agent-manager">Agent Manager</a>
|
|
70
|
-
<a href="/codex-enterprise">Codex Enterprise</a>
|
|
71
293
|
<a href="/agents-cost-savings">FinOps for Agents</a>
|
|
72
|
-
<a href="/federal">Federal</a>
|
|
73
294
|
<a href="/dashboard">Dashboard demo</a>
|
|
74
295
|
<a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
|
|
75
296
|
</nav>
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
<
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
<
|
|
87
|
-
<p
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
<p
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
297
|
+
|
|
298
|
+
<div class="wrap">
|
|
299
|
+
<header class="hero">
|
|
300
|
+
<div>
|
|
301
|
+
<div style="display: inline-block; border-left: 3px solid #fbbf24; background: rgba(251, 191, 36, 0.08); padding: 0.7rem 1rem; margin-bottom: 1.25rem; border-radius: 0 6px 6px 0; max-width: 760px;">
|
|
302
|
+
<strong style="color: #fbbf24; font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.08em; display: block; margin-bottom: 0.25rem;">Why this matters now — 2026</strong>
|
|
303
|
+
<span style="color: var(--text); font-size: 0.95rem; line-height: 1.55;">Sullivan & Cromwell apologized to a federal judge for AI-hallucinated citations — despite policies, mandatory training, and verification requirements. Gordon Rees did the same on a bankruptcy filing. The <a href="https://www.damiencharlotin.com/hallucinations/" target="_blank" rel="noopener" style="color: #fbbf24">public hallucination-cases database</a> now catalogs <strong>1,369+ rulings</strong>. The firms with policies still got sanctioned. <em>Policies are not enforcement.</em> A runtime gate is.</span>
|
|
304
|
+
</div>
|
|
305
|
+
<span class="eyebrow">Pre-read for law-firm AI governance pilots</span>
|
|
306
|
+
<h1>Pre-execution controls for legal AI agents.</h1>
|
|
307
|
+
<p class="lead">Block unauthorized advice, conflict-check failures, privilege leaks, and unapproved model calls before an intake agent replies, fetches records, schedules a meeting, or sends data outside the firm's approved boundary.</p>
|
|
308
|
+
<p style="color: var(--soft); font-size: 0.98rem; max-width: 760px; margin: 0 0 1.1rem; padding: 0.7rem 1rem; border-left: 3px solid var(--green); background: rgba(114, 227, 165, 0.06); border-radius: 0 6px 6px 0;">
|
|
309
|
+
<strong style="color: var(--green)">Predictability you can put in front of a client.</strong>
|
|
310
|
+
Pre-execution controls aren't just defensive — they make agentic-AI deployment <em>predictable enough to sell</em>. Innovation teams at law firms have always had to choose between speed and certainty. The runtime gate lets you have both: the agent moves at machine speed, the gate enforces firm-specific policy deterministically, and every decision ships an audit log your pricing partners can underwrite. <strong style="color: var(--soft)">Predictability. Insights. Value.</strong> The three things your innovation team already promises clients — extended to the agentic surface.
|
|
311
|
+
</p>
|
|
312
|
+
<p style="color: var(--soft); font-size: 0.95rem; max-width: 760px; margin: 0 0 1rem; padding: 0.55rem 0.85rem; border-left: 3px solid var(--cyan); background: rgba(45, 212, 191, 0.05); border-radius: 0 6px 6px 0;">
|
|
313
|
+
<strong style="color: var(--cyan)">The gate learns from your attorneys.</strong>
|
|
314
|
+
Every 👍 / 👎 an attorney logs on an AI answer becomes a lesson in your firm's local DB. Recurring patterns promote to deterministic rules. The next time a similar action is proposed, the rule fires before any human is asked to approve.
|
|
315
|
+
<a href="/learn/feedback-loop-vs-decision-layer" style="color: var(--cyan); white-space: nowrap;">How the feedback loop works →</a>
|
|
316
|
+
</p>
|
|
317
|
+
<div class="hero-actions">
|
|
318
|
+
<a class="cta" href="mailto:iganapolsky@gmail.com?subject=ThumbGate%2025-minute%20legal%20AI%20pilot%20walkthrough&body=Hi%20Igor%2C%0A%0AWe%27d%20like%20to%20review%20the%2025-minute%20ThumbGate%20legal%20AI%20intake%20pilot.%20Please%20send%20the%20meeting%20invite%20and%20demo%20materials.%0A%0ABest%2C">Book a 25-minute pilot walkthrough</a>
|
|
319
|
+
<a class="ghost" href="#live-gate-demos">Try the live gates →</a>
|
|
320
|
+
<a class="ghost" href="#demo">View the 25-minute demo plan</a>
|
|
321
|
+
</div>
|
|
322
|
+
<div class="proof-row" aria-label="Key proof points">
|
|
323
|
+
<div class="proof"><strong>Preloaded controls</strong><span>Firm policy, approved disclaimers, adverse-party lists, routing rules, and model endpoint allowlists.</span></div>
|
|
324
|
+
<div class="proof"><strong>Pre-action checks</strong><span>Controls run before the agent replies, fetches records, schedules intake, or calls an external model.</span></div>
|
|
325
|
+
<div class="proof"><strong>Reviewable evidence</strong><span>Every block, warning, override, and handoff becomes a structured audit event.</span></div>
|
|
326
|
+
</div>
|
|
327
|
+
<div class="trust-strip" aria-label="Trust and deployment assumptions">
|
|
328
|
+
<div class="trust-item">Local-first enforcement option</div>
|
|
329
|
+
<div class="trust-item">Works around Azure OpenAI, Claude, Gemini, and internal tools</div>
|
|
330
|
+
<div class="trust-item">ABA Formal Opinion 512 mapped to reviewable controls</div>
|
|
331
|
+
<div class="trust-item">No guaranteed-malpractice-prevention claim</div>
|
|
332
|
+
</div>
|
|
96
333
|
</div>
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
<
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
<
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
334
|
+
|
|
335
|
+
<aside class="control-flow" aria-label="ThumbGate pre-action control flow">
|
|
336
|
+
<img class="flow-asset" src="/assets/legal-intake-control-flow.svg" alt="Diagram of the ThumbGate legal intake pre-action control flow">
|
|
337
|
+
<h2>What the demo should show</h2>
|
|
338
|
+
<div class="flow-step">
|
|
339
|
+
<span class="num">1</span>
|
|
340
|
+
<div>
|
|
341
|
+
<h3>Prospect asks a risky intake question</h3>
|
|
342
|
+
<p>"Can I sue my former employer in Florida if they changed my commission plan?"</p>
|
|
343
|
+
</div>
|
|
344
|
+
</div>
|
|
345
|
+
<div class="flow-step blocked">
|
|
346
|
+
<span class="num">2</span>
|
|
347
|
+
<div>
|
|
348
|
+
<h3>Advice-shaped response is stopped</h3>
|
|
349
|
+
<p>Legal conclusion plus jurisdictional recommendation is routed to attorney review before delivery.</p>
|
|
350
|
+
</div>
|
|
351
|
+
</div>
|
|
352
|
+
<div class="flow-step cleared">
|
|
353
|
+
<span class="num">3</span>
|
|
354
|
+
<div>
|
|
355
|
+
<h3>Safe handoff is allowed</h3>
|
|
356
|
+
<p>The agent collects neutral routing details and schedules review without creating reliance.</p>
|
|
357
|
+
</div>
|
|
358
|
+
</div>
|
|
359
|
+
<div class="flow-step">
|
|
360
|
+
<span class="num">4</span>
|
|
361
|
+
<div>
|
|
362
|
+
<h3>Audit event is exportable</h3>
|
|
363
|
+
<p>Rule version, source policy, proposed action, outcome, reviewer, and timestamp are preserved.</p>
|
|
364
|
+
</div>
|
|
365
|
+
</div>
|
|
366
|
+
</aside>
|
|
367
|
+
</header>
|
|
368
|
+
|
|
369
|
+
<main>
|
|
370
|
+
<section>
|
|
371
|
+
<h2>Why this is credible now.</h2>
|
|
372
|
+
<p class="section-lead">The market is not waiting for perfect AI. Large firms are adopting legal AI while ethics, security, and innovation teams are still formalizing the controls around it. ThumbGate fits that gap: it is not another research assistant; it is a control point around the assistants and agents a firm already wants to evaluate. Governance has to live outside the model's context window. If the agent can reason around the rule, it is not really a rule.</p>
|
|
373
|
+
<div class="grid">
|
|
374
|
+
<div class="card">
|
|
375
|
+
<span class="tag blue">Governance</span>
|
|
376
|
+
<h3>ABA Formal Opinion 512 maps cleanly to controls</h3>
|
|
377
|
+
<p>Competence, confidentiality, supervision, verification, communication, and reasonable fees become concrete checks and review records.</p>
|
|
378
|
+
</div>
|
|
379
|
+
<div class="card">
|
|
380
|
+
<span class="tag amber">Adoption</span>
|
|
381
|
+
<h3>AI is entering normal workflows</h3>
|
|
382
|
+
<p>The practical buyer question is no longer "will lawyers use AI?" It is "which actions can an agent take without review?"</p>
|
|
383
|
+
</div>
|
|
384
|
+
<div class="card">
|
|
385
|
+
<span class="tag green">Positioning</span>
|
|
386
|
+
<h3>Vendor-neutral by design</h3>
|
|
387
|
+
<p>The pilot can sit around internal tools, Azure OpenAI, Claude, Gemini, document systems, or purpose-built legal AI products.</p>
|
|
388
|
+
</div>
|
|
389
|
+
</div>
|
|
390
|
+
</section>
|
|
391
|
+
|
|
392
|
+
<section>
|
|
393
|
+
<h2>The pilot is an AI-SDLC control layer, not a chatbot demo.</h2>
|
|
394
|
+
<p class="section-lead">The strongest buyer framing is simple: the firm may already have agents, copilots, research tools, and intake experiments. What it still needs is the system around those agents: triggers, isolated runs, approved context, visibility, and controls that live outside the model prompt.</p>
|
|
395
|
+
<div class="grid">
|
|
396
|
+
<div class="card">
|
|
397
|
+
<span class="tag blue">Trigger</span>
|
|
398
|
+
<h3>Define what starts legal AI work</h3>
|
|
399
|
+
<p>A pilot run should begin from a scoped intake event, not an open-ended prompt. The event carries practice area, jurisdiction, allowed tools, reviewer role, and done criteria.</p>
|
|
400
|
+
</div>
|
|
401
|
+
<div class="card">
|
|
402
|
+
<span class="tag amber">Context</span>
|
|
403
|
+
<h3>Load only approved firm ground truth</h3>
|
|
404
|
+
<p>Disclaimers, adverse-party fixtures, model allowlists, routing policy, and supervision rules should be versioned inputs, not improvised chat context.</p>
|
|
405
|
+
</div>
|
|
406
|
+
<div class="card">
|
|
407
|
+
<span class="tag green">Controls</span>
|
|
408
|
+
<h3>Block before the action happens</h3>
|
|
409
|
+
<p>Pre-action gates stop advice-shaped replies, conflict-precheck bypass, and confidential egress before the agent sends, fetches, schedules, or calls out.</p>
|
|
410
|
+
</div>
|
|
411
|
+
</div>
|
|
412
|
+
<div class="callout" style="margin-top:1rem;">
|
|
413
|
+
<p><strong>Executive takeaway:</strong> ThumbGate does not ask a law firm to trust a bigger prompt. It gives risk, innovation, and security teams a reviewable control point between the agent and the next privileged action.</p>
|
|
414
|
+
<p><a href="/learn/background-agent-control-layer">Read the background-agent control-layer brief →</a></p>
|
|
415
|
+
</div>
|
|
416
|
+
</section>
|
|
417
|
+
|
|
418
|
+
<section>
|
|
419
|
+
<h2>Yes, the pilot can start with preloaded ground truth.</h2>
|
|
420
|
+
<p class="section-lead">The first pilot should not ask the model to discover the firm's risk posture. ThumbGate should load the approved rule pack before the first intake simulation, then prove that the agent is physically stopped when a proposed action violates that pack.</p>
|
|
421
|
+
<div class="grid">
|
|
422
|
+
<div class="card">
|
|
423
|
+
<span class="tag green">Inputs</span>
|
|
424
|
+
<h3>Firm-approved source material</h3>
|
|
425
|
+
<p>Disclaimers, intake scripts, escalation rules, practice-area boundaries, jurisdiction notes, model endpoint policy, retention rules, and reviewer roles.</p>
|
|
426
|
+
</div>
|
|
427
|
+
<div class="card">
|
|
428
|
+
<span class="tag amber">Fixtures</span>
|
|
429
|
+
<h3>Adverse-party and matter examples</h3>
|
|
430
|
+
<p>A synthetic adverse-party list and red-team intake transcripts let the demo show conflict stops without exposing privileged or client data.</p>
|
|
431
|
+
</div>
|
|
432
|
+
<div class="card">
|
|
433
|
+
<span class="tag blue">Outputs</span>
|
|
434
|
+
<h3>Deterministic control evidence</h3>
|
|
435
|
+
<p>Each demo decision shows the matched rule, proposed action, allowed or blocked outcome, reviewer path, timestamp, and exportable audit record.</p>
|
|
436
|
+
</div>
|
|
437
|
+
</div>
|
|
438
|
+
</section>
|
|
439
|
+
|
|
440
|
+
<section>
|
|
441
|
+
<h2>Three failure modes the pilot should control.</h2>
|
|
442
|
+
<div class="grid">
|
|
443
|
+
<div class="card">
|
|
444
|
+
<span class="tag red">UPL</span>
|
|
445
|
+
<h3>Unauthorized-practice risk</h3>
|
|
446
|
+
<p>Block outcome predictions, jurisdictional recommendations, and advice-shaped responses from non-attorney intake agents. Allow neutral collection and attorney handoff.</p>
|
|
447
|
+
</div>
|
|
448
|
+
<div class="card">
|
|
449
|
+
<span class="tag amber">Conflicts</span>
|
|
450
|
+
<h3>Conflict preconditions</h3>
|
|
451
|
+
<p>Require configured adverse-party clearance before the agent continues intake or requests sensitive matter facts.</p>
|
|
452
|
+
</div>
|
|
453
|
+
<div class="card">
|
|
454
|
+
<span class="tag blue">Privilege</span>
|
|
455
|
+
<h3>Confidentiality and egress</h3>
|
|
456
|
+
<p>Block or reroute outbound calls that include privileged markers, matter identifiers, or firm-classified confidential content.</p>
|
|
457
|
+
</div>
|
|
458
|
+
</div>
|
|
459
|
+
</section>
|
|
460
|
+
|
|
461
|
+
<section id="demo">
|
|
462
|
+
<h2>25-minute walkthrough agenda.</h2>
|
|
463
|
+
<p class="section-lead">The call should be visual. The goal is not to prove every enterprise feature. It is to show a repeatable mechanism the innovation team can explain internally.</p>
|
|
464
|
+
<div class="two grid">
|
|
465
|
+
<div class="card">
|
|
466
|
+
<h3>Show these assets</h3>
|
|
467
|
+
<ul>
|
|
468
|
+
<li>One unsafe intake transcript and blocked response.</li>
|
|
469
|
+
<li>One conflict-precheck stop before sensitive facts are collected.</li>
|
|
470
|
+
<li>One egress block or safe in-tenant reroute.</li>
|
|
471
|
+
<li>One audit export with rule version, source, outcome, and reviewer.</li>
|
|
472
|
+
</ul>
|
|
473
|
+
</div>
|
|
474
|
+
<div class="card">
|
|
475
|
+
<h3>Skip these on the first call</h3>
|
|
476
|
+
<ul>
|
|
477
|
+
<li>Broad platform tour.</li>
|
|
478
|
+
<li>Pricing page or checkout flow.</li>
|
|
479
|
+
<li>Unverified sanctions statistics.</li>
|
|
480
|
+
<li>Claims about SOC 2, BAA, carrier discounts, or guaranteed malpractice prevention.</li>
|
|
481
|
+
</ul>
|
|
482
|
+
</div>
|
|
483
|
+
</div>
|
|
484
|
+
<div class="two grid" style="margin-top:1rem;">
|
|
485
|
+
<div class="card">
|
|
486
|
+
<h3>Suggested agenda</h3>
|
|
487
|
+
<ul>
|
|
488
|
+
<li>3 minutes: confirm the target workflow and risk owners.</li>
|
|
489
|
+
<li>7 minutes: show blocked unauthorized-advice and conflict examples.</li>
|
|
490
|
+
<li>7 minutes: show preloaded ground truth and audit evidence.</li>
|
|
491
|
+
<li>5 minutes: discuss deployment boundary, data handling, and reviewer roles.</li>
|
|
492
|
+
<li>3 minutes: agree on pilot inputs and next step.</li>
|
|
493
|
+
</ul>
|
|
494
|
+
</div>
|
|
495
|
+
<div class="card">
|
|
496
|
+
<h3>Recommended ask</h3>
|
|
497
|
+
<p>Ask for one practice-area workflow, one approved disclaimer, one synthetic adverse-party fixture, one security contact, and permission to build a no-client-data pilot pack.</p>
|
|
498
|
+
</div>
|
|
499
|
+
</div>
|
|
500
|
+
</section>
|
|
501
|
+
|
|
502
|
+
<section>
|
|
503
|
+
<h2>Procurement questions to answer early.</h2>
|
|
504
|
+
<table class="matrix">
|
|
505
|
+
<thead>
|
|
506
|
+
<tr><th>Buyer question</th><th>Pilot answer</th><th>Evidence to bring</th></tr>
|
|
507
|
+
</thead>
|
|
508
|
+
<tbody>
|
|
509
|
+
<tr><td>Will our data train models?</td><td>The pilot can run inside the firm's boundary. Hosted services should receive only counters and rule metadata unless explicitly approved.</td><td>Data-flow diagram, retention note, subprocessor list.</td></tr>
|
|
510
|
+
<tr><td>Who can see privileged data?</td><td>Default pilot design keeps privileged payloads in the firm's environment, with access governed by their controls.</td><td>Architecture note and access-control assumptions.</td></tr>
|
|
511
|
+
<tr><td>Can we reproduce a decision later?</td><td>Each event should preserve the rule version, source policy, proposed action, decision, reviewer, and timestamp.</td><td>Sample audit export.</td></tr>
|
|
512
|
+
<tr><td>How do we tune false positives?</td><td>Use hard block, review queue, warning, and allow modes. Promote rules only after test examples and attorney approval.</td><td>Rule lifecycle and override examples.</td></tr>
|
|
513
|
+
</tbody>
|
|
514
|
+
</table>
|
|
515
|
+
</section>
|
|
516
|
+
|
|
517
|
+
<section>
|
|
518
|
+
<div class="callout">
|
|
519
|
+
<h2>Recommended 30-day pilot.</h2>
|
|
520
|
+
<p>Start narrow: one intake channel, one practice-area workflow, one adverse-party fixture, one approved-model routing policy, and one audit export format.</p>
|
|
521
|
+
<p>Deliverables: preloaded rule pack, demo agent, screenshot set, 60-second walkthrough clip, security data-flow note, pilot metrics, and a go/no-go rollout recommendation.</p>
|
|
522
|
+
<p style="margin:1.2rem 0 0.6rem;color:var(--amber);font-size:1.1rem;font-weight:700;">Pilot setup fee: $2,500 – $7,500 flat (scope-dependent). No per-seat or per-query billing during the pilot.</p>
|
|
523
|
+
<div style="display:flex;gap:1rem;flex-wrap:wrap;margin-top:1rem;">
|
|
524
|
+
<a class="cta" href="mailto:iganapolsky@gmail.com?subject=ThumbGate%2025-minute%20legal%20AI%20pilot%20walkthrough&body=Hi%20Igor%2C%0A%0AWe%27d%20like%20to%20review%20the%2025-minute%20ThumbGate%20legal%20AI%20intake%20pilot.%20Please%20send%20the%20meeting%20invite%20and%20demo%20materials.%0A%0ABest%2C">Book a 25-minute pilot walkthrough</a>
|
|
525
|
+
<a class="ghost" href="/dashboard">View the live dashboard demo</a>
|
|
526
|
+
</div>
|
|
527
|
+
</div>
|
|
528
|
+
</section>
|
|
529
|
+
|
|
530
|
+
<section id="live-gate-demos">
|
|
531
|
+
<h2>Live gate demos — try them yourself</h2>
|
|
532
|
+
<div style="border-left: 3px solid var(--cyan); background: rgba(34, 211, 238, 0.06); padding: 0.85rem 1.1rem; margin: 0 0 1.5rem; border-radius: 0 6px 6px 0;">
|
|
533
|
+
<strong style="color: var(--cyan)">Monitor vs enforce.</strong> <span style="color: var(--text)">Agent observability tools log what your agent <em>did</em>. ThumbGate gates what your agent is <em>about to do</em> — runtime block before execution, not retrospective alert after the harm. SIEM ingestion is the audit trail. The PreToolUse hook is the prevention.</span>
|
|
534
|
+
</div>
|
|
535
|
+
<p style="color:var(--muted); margin-bottom:1.5rem">These simulators use the exact same deterministic PreToolUse logic that runs in production. No LLM calls on the enforcement path — just fast, auditable pattern matching.</p>
|
|
536
|
+
|
|
537
|
+
<!-- UPL Gate Simulator -->
|
|
538
|
+
<div class="card" style="margin-bottom:2rem">
|
|
539
|
+
<h3 style="color:var(--cyan); margin-bottom:0.75rem">1. UPL Gate — advice-shaped output detector</h3>
|
|
540
|
+
<p style="font-size:0.95rem; color:var(--muted)">Type what a client might ask an intake bot. The gate detects predictions, recommendations, or jurisdictional legal analysis from a non-attorney source and blocks delivery.</p>
|
|
541
|
+
<textarea id="upl-input" placeholder="E.g. 'Based on the facts you described, you likely have a strong claim for breach of contract and could recover significant damages.'" style="width:100%; height:90px; background:#0f0f11; color:var(--text); border:1px solid var(--line); border-radius:8px; padding:0.75rem; font-size:0.95rem; resize:vertical; margin:0.75rem 0"></textarea>
|
|
542
|
+
<button onclick="runUPLDemo()" class="cta" style="padding:0.6rem 1.1rem; font-size:0.9rem">Run through UPL Gate</button>
|
|
543
|
+
<div id="upl-result" class="demo-result" style="display:none"></div>
|
|
544
|
+
</div>
|
|
545
|
+
|
|
546
|
+
<!-- Conflict Check Simulator -->
|
|
547
|
+
<div class="card" style="margin-bottom:2rem">
|
|
548
|
+
<h3 style="color:var(--cyan); margin-bottom:0.75rem">2. Conflict Gate — adverse party clearance</h3>
|
|
549
|
+
<p style="font-size:0.95rem; color:var(--muted)">Enter a prospective client or party name. The gate checks against a sample adverse-parties list (real firms maintain much larger lists).</p>
|
|
550
|
+
<div style="display:flex; gap:0.75rem; align-items:flex-end; margin:0.75rem 0; flex-wrap:wrap">
|
|
551
|
+
<div style="flex:1; min-width:240px">
|
|
552
|
+
<label style="font-size:0.8rem; color:var(--muted); display:block; margin-bottom:0.25rem">Party / Company Name</label>
|
|
553
|
+
<input id="conflict-input" type="text" placeholder="Latam Real Capital" value="Latam Real Capital S.A." style="width:100%; background:#0f0f11; color:var(--text); border:1px solid var(--line); border-radius:8px; padding:0.6rem; font-size:0.95rem">
|
|
554
|
+
</div>
|
|
555
|
+
<button onclick="runConflictDemo()" class="cta" style="padding:0.6rem 1.1rem; font-size:0.9rem; white-space:nowrap">Check Against Adverse List</button>
|
|
556
|
+
</div>
|
|
557
|
+
<div style="font-size:0.8rem; color:var(--muted); margin-bottom:0.5rem">Sample adverse list (synthetic, illustrative): Latam Real Capital S.A. (real estate #M-2847), Hospitalia Holdings (hospitality M&A #M-2911), NovaIA Latam (AI venture #M-2755)</div>
|
|
558
|
+
<div id="conflict-result" class="demo-result" style="display:none"></div>
|
|
559
|
+
</div>
|
|
560
|
+
|
|
561
|
+
<!-- Privilege Egress Simulator -->
|
|
562
|
+
<div class="card">
|
|
563
|
+
<h3 style="color:var(--cyan); margin-bottom:0.75rem">3. Egress Gate — privilege marker detector</h3>
|
|
564
|
+
<p style="font-size:0.95rem; color:var(--muted)">Paste content an agent might try to send to an external LLM (e.g. deposition summary request). The gate blocks if it detects privilege markers.</p>
|
|
565
|
+
<textarea id="privilege-input" placeholder="Please summarize this deposition transcript. [Attorney Work Product - Matter M-2847 - Confidential]" style="width:100%; height:90px; background:#0f0f11; color:var(--text); border:1px solid var(--line); border-radius:8px; padding:0.75rem; font-size:0.95rem; resize:vertical; margin:0.75rem 0"></textarea>
|
|
566
|
+
<button onclick="runPrivilegeDemo()" class="cta" style="padding:0.6rem 1.1rem; font-size:0.9rem">Attempt External LLM Call</button>
|
|
567
|
+
<div id="privilege-result" class="demo-result" style="display:none"></div>
|
|
568
|
+
</div>
|
|
569
|
+
|
|
570
|
+
<script>
|
|
571
|
+
function escapeHtml(s) {
|
|
572
|
+
return String(s).replace(/[&<>"']/g, function(c) {
|
|
573
|
+
return { '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c];
|
|
574
|
+
});
|
|
575
|
+
}
|
|
576
|
+
// Produces the same JSON shape a production ThumbGate gate would stream to the firm's SIEM.
|
|
577
|
+
// Includes ISO 27001 control mapping so procurement can map evidence to controls without translation.
|
|
578
|
+
window.__thumbgateBuildAudit = function(args) {
|
|
579
|
+
return {
|
|
580
|
+
audit_id: args.audit_id,
|
|
581
|
+
timestamp_iso: args.timestamp_iso,
|
|
582
|
+
rule: { id: args.rule_id, version: args.rule_version, matched: args.matched },
|
|
583
|
+
blocked_call: {
|
|
584
|
+
agent: args.agent,
|
|
585
|
+
input_excerpt: String(args.input || '').slice(0, 280),
|
|
586
|
+
matter_context: args.matter_context
|
|
587
|
+
},
|
|
588
|
+
action: args.action,
|
|
589
|
+
reviewer: null,
|
|
590
|
+
iso_27001_controls: args.iso_controls,
|
|
591
|
+
generated_by: 'ThumbGate PreToolUse Gate (sample export — production version streams to your SIEM)',
|
|
592
|
+
sample_disclaimer: 'Synthetic audit record for evaluation. No real client data referenced.'
|
|
593
|
+
};
|
|
594
|
+
};
|
|
595
|
+
window.__thumbgateDownloadAudit = function(payload, filename) {
|
|
596
|
+
try {
|
|
597
|
+
var json = JSON.stringify(payload, null, 2);
|
|
598
|
+
var blob = new Blob([json], { type: 'application/json' });
|
|
599
|
+
var url = URL.createObjectURL(blob);
|
|
600
|
+
var a = document.createElement('a');
|
|
601
|
+
a.href = url; a.download = filename;
|
|
602
|
+
document.body.appendChild(a); a.click();
|
|
603
|
+
document.body.removeChild(a);
|
|
604
|
+
setTimeout(function() { URL.revokeObjectURL(url); }, 10000);
|
|
605
|
+
} catch (e) { console.error('audit download failed', e); }
|
|
606
|
+
};
|
|
607
|
+
window.__thumbgateAuditRegistry = {};
|
|
608
|
+
window.__thumbgateAuditByKey = function(key) {
|
|
609
|
+
var entry = window.__thumbgateAuditRegistry[key];
|
|
610
|
+
if (!entry) return;
|
|
611
|
+
window.__thumbgateDownloadAudit(entry.payload, entry.filename);
|
|
612
|
+
};
|
|
613
|
+
window.__thumbgateAuditButton = function(key, payload, filename) {
|
|
614
|
+
window.__thumbgateAuditRegistry[key] = { payload: payload, filename: filename };
|
|
615
|
+
return '<button class="cta" style="margin-top:0.5rem; padding:0.45rem 0.9rem; font-size:0.82rem; background:transparent; color:var(--cyan); border:1px solid var(--cyan)" ' +
|
|
616
|
+
'onclick="__thumbgateAuditByKey(\'' + key + '\')">' +
|
|
617
|
+
'Download audit JSON (sample) ↓</button>';
|
|
618
|
+
};
|
|
619
|
+
function runUPLDemo() {
|
|
620
|
+
var input = document.getElementById('upl-input').value.trim();
|
|
621
|
+
var resultDiv = document.getElementById('upl-result');
|
|
622
|
+
if (!input) { resultDiv.style.display = 'none'; return; }
|
|
623
|
+
var advicePatterns = ['you have a strong case', 'likely to win', 'you should', 'recommend that you', 'based on the facts you described', 'in my opinion', 'the best course is', 'you are entitled to'];
|
|
624
|
+
var lower = input.toLowerCase();
|
|
625
|
+
var blocked = false;
|
|
626
|
+
var reason = '';
|
|
627
|
+
for (var i = 0; i < advicePatterns.length; i++) {
|
|
628
|
+
if (lower.indexOf(advicePatterns[i]) !== -1) { blocked = true; reason = advicePatterns[i]; break; }
|
|
629
|
+
}
|
|
630
|
+
if (blocked) {
|
|
631
|
+
var uplPayload = __thumbgateBuildAudit({
|
|
632
|
+
audit_id: 'UPL-2847-20260526-091204',
|
|
633
|
+
timestamp_iso: '2026-05-26T09:12:04Z',
|
|
634
|
+
rule_id: 'UPL_RULE_05.5_ADVICE_SHAPE',
|
|
635
|
+
rule_version: '3.2',
|
|
636
|
+
matched: 'advice-shaped output from non-attorney source ("' + reason + '")',
|
|
637
|
+
agent: 'website-intake-bot-v2',
|
|
638
|
+
input: input,
|
|
639
|
+
matter_context: 'New client intake (web)',
|
|
640
|
+
action: 'REPLACE + LOG + NOTIFY_ATTORNEY',
|
|
641
|
+
iso_controls: ['A.5.34 (Privacy & PII protection)', 'A.5.24 (Information security incident management)']
|
|
642
|
+
});
|
|
643
|
+
resultDiv.innerHTML =
|
|
644
|
+
'<div class="demo-blocked">' +
|
|
645
|
+
'<strong style="color:#f87171">BLOCKED — UPL Gate fired</strong><br>' +
|
|
646
|
+
'Detected advice-shaped pattern: "' + escapeHtml(reason) + '"<br><br>' +
|
|
647
|
+
'<strong>Corrective action taken:</strong><br>' +
|
|
648
|
+
'Response replaced with: <em>"That\'s a legal question best answered by a licensed attorney. I can schedule a 30-minute consultation with one of our [practice area] attorneys — would [time] work for you?"</em><br><br>' +
|
|
649
|
+
'<div class="audit-log">[2026-05-26 09:12:04] PreToolUse gate: UPL_RULE_05.5_ADVICE_SHAPE v3.2\nRule matched: advice-shaped output from non-attorney source\nAction: REPLACE + LOG + NOTIFY_ATTORNEY\nAudit ID: UPL-2847-20260526-091204\nMatter context: New client intake (web)\nAgent: website-intake-bot-v2</div>' +
|
|
650
|
+
__thumbgateAuditButton('upl', uplPayload, 'ThumbGate-Audit-UPL-2847-2026-05-26.json') +
|
|
651
|
+
'</div>';
|
|
652
|
+
} else {
|
|
653
|
+
resultDiv.innerHTML =
|
|
654
|
+
'<div class="demo-cleared">' +
|
|
655
|
+
'<strong style="color:#34d399">CLEARED — no UPL pattern detected</strong><br>' +
|
|
656
|
+
'Response would be delivered as-is. (In production this would still be logged for training.)' +
|
|
657
|
+
'</div>';
|
|
658
|
+
}
|
|
659
|
+
resultDiv.style.display = 'block';
|
|
660
|
+
}
|
|
661
|
+
|
|
662
|
+
function runConflictDemo() {
|
|
663
|
+
var party = document.getElementById('conflict-input').value.trim().toLowerCase();
|
|
664
|
+
var resultDiv = document.getElementById('conflict-result');
|
|
665
|
+
if (!party) { resultDiv.style.display = 'none'; return; }
|
|
666
|
+
var adverseList = ['latam real capital', 'latam real', 'hospitalia holdings', 'hospitalia', 'novaia latam', 'novaia'];
|
|
667
|
+
var isAdverse = adverseList.some(function(a) { return party.indexOf(a) !== -1; });
|
|
668
|
+
if (isAdverse) {
|
|
669
|
+
var conflictPayload = __thumbgateBuildAudit({
|
|
670
|
+
audit_id: 'CONF-2911-20260526-091204',
|
|
671
|
+
timestamp_iso: '2026-05-26T09:12:04Z',
|
|
672
|
+
rule_id: 'CONFLICT_RULE_1.7_ADVERSE',
|
|
673
|
+
rule_version: '4.1',
|
|
674
|
+
matched: 'adverse-parties list match for "' + party + '"',
|
|
675
|
+
agent: 'doc-fetch-agent-v1',
|
|
676
|
+
input: party,
|
|
677
|
+
matter_context: 'New M&A intake — preliminary conflict check',
|
|
678
|
+
action: 'BLOCK + REDIRECT + LOG',
|
|
679
|
+
iso_controls: ['A.5.10 (Acceptable use of information)', 'A.5.24 (Information security incident management)', 'A.8.10 (Information deletion)']
|
|
680
|
+
});
|
|
681
|
+
resultDiv.innerHTML =
|
|
682
|
+
'<div class="demo-blocked">' +
|
|
683
|
+
'<strong style="color:#f87171">BLOCKED — Conflict Gate fired</strong><br>' +
|
|
684
|
+
'"' + escapeHtml(party) + '" matches adverse party in existing matter.<br><br>' +
|
|
685
|
+
'<strong>Corrective action:</strong> Fetch blocked. Agent redirected to: <em>"This party appears as adverse in matter M-2847. Contact ethics screen lead before proceeding."</em><br><br>' +
|
|
686
|
+
'<div class="audit-log">[2026-05-26 09:12:04] PreToolUse gate: CONFLICT_RULE_1.7_ADVERSE v4.1\nMatched: adverse-parties list\nAction: BLOCK + REDIRECT + LOG\nAudit ID: CONF-2911-20260526-091204\nRequesting matter: New M&A intake\nAgent: doc-fetch-agent-v1</div>' +
|
|
687
|
+
__thumbgateAuditButton('conflict', conflictPayload, 'ThumbGate-Audit-CONF-2911-2026-05-26.json') +
|
|
688
|
+
'</div>';
|
|
689
|
+
} else {
|
|
690
|
+
resultDiv.innerHTML =
|
|
691
|
+
'<div class="demo-cleared">' +
|
|
692
|
+
'<strong style="color:#34d399">CLEARED — no conflict found</strong><br>' +
|
|
693
|
+
'Positive clearance recorded. Agent may proceed with intake.<br><br>' +
|
|
694
|
+
'<div class="audit-log">[2026-05-26 09:12:04] PreToolUse gate: CONFLICT_RULE_1.7_ADVERSE v4.1\nResult: CLEAR (no match in adverse list)\nAction: ALLOW + LOG\nAudit ID: CONF-2912-20260526-091204</div>' +
|
|
695
|
+
'</div>';
|
|
696
|
+
}
|
|
697
|
+
resultDiv.style.display = 'block';
|
|
698
|
+
}
|
|
699
|
+
|
|
700
|
+
function runPrivilegeDemo() {
|
|
701
|
+
var input = document.getElementById('privilege-input').value.trim();
|
|
702
|
+
var resultDiv = document.getElementById('privilege-result');
|
|
703
|
+
if (!input) { resultDiv.style.display = 'none'; return; }
|
|
704
|
+
var privMarkers = ['attorney work product', 'privileged', 'confidential - attorney client', 'matter m-', 'm-2847', 'm-2911'];
|
|
705
|
+
var lower = input.toLowerCase();
|
|
706
|
+
var blocked = false;
|
|
707
|
+
var marker = '';
|
|
708
|
+
for (var i = 0; i < privMarkers.length; i++) {
|
|
709
|
+
if (lower.indexOf(privMarkers[i]) !== -1) { blocked = true; marker = privMarkers[i]; break; }
|
|
710
|
+
}
|
|
711
|
+
if (blocked) {
|
|
712
|
+
var privilegePayload = __thumbgateBuildAudit({
|
|
713
|
+
audit_id: 'PRIV-2755-20260526-091204',
|
|
714
|
+
timestamp_iso: '2026-05-26T09:12:04Z',
|
|
715
|
+
rule_id: 'EGRESS_RULE_1.6_PRIVILEGE',
|
|
716
|
+
rule_version: '2.8',
|
|
717
|
+
matched: 'privilege marker in outbound payload ("' + marker + '")',
|
|
718
|
+
agent: 'brief-assistant-v3',
|
|
719
|
+
input: input,
|
|
720
|
+
matter_context: 'Outbound LLM call from attorney workspace',
|
|
721
|
+
action: 'BLOCK + REDIRECT_TO_TENANT_LLM + LOG',
|
|
722
|
+
iso_controls: ['A.5.34 (Privacy & PII protection)', 'A.5.14 (Information transfer)', 'A.8.24 (Use of cryptography)']
|
|
723
|
+
});
|
|
724
|
+
resultDiv.innerHTML =
|
|
725
|
+
'<div class="demo-blocked">' +
|
|
726
|
+
'<strong style="color:#f87171">BLOCKED — Egress Gate fired</strong><br>' +
|
|
727
|
+
'Detected privilege marker: "' + escapeHtml(marker) + '"<br><br>' +
|
|
728
|
+
'<strong>Corrective action:</strong> Outbound call to external LLM blocked. Redirected to in-tenant Azure OpenAI (BAA-protected) or internal summarizer.<br><br>' +
|
|
729
|
+
'<div class="audit-log">[2026-05-26 09:12:04] PreToolUse gate: EGRESS_RULE_1.6_PRIVILEGE v2.8\nRule matched: privilege marker in outbound payload\nAction: BLOCK + REDIRECT_TO_TENANT_LLM + LOG\nAudit ID: PRIV-2755-20260526-091204\nContent hash: sha256:7f3a... (truncated)\nAgent: brief-assistant-v3</div>' +
|
|
730
|
+
__thumbgateAuditButton('privilege', privilegePayload, 'ThumbGate-Audit-PRIV-2755-2026-05-26.json') +
|
|
731
|
+
'</div>';
|
|
732
|
+
} else {
|
|
733
|
+
resultDiv.innerHTML =
|
|
734
|
+
'<div class="demo-cleared">' +
|
|
735
|
+
'<strong style="color:#34d399">CLEARED — no privilege markers detected</strong><br>' +
|
|
736
|
+
'Content would be sent to external LLM (in production this would still trigger logging + optional human review flag).' +
|
|
737
|
+
'</div>';
|
|
738
|
+
}
|
|
739
|
+
resultDiv.style.display = 'block';
|
|
740
|
+
}
|
|
741
|
+
|
|
742
|
+
// Keyboard support: Enter submits, Shift+Enter inserts newline
|
|
743
|
+
var uplEl = document.getElementById('upl-input');
|
|
744
|
+
if (uplEl) uplEl.addEventListener('keydown', function(e) {
|
|
745
|
+
if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); runUPLDemo(); }
|
|
746
|
+
});
|
|
747
|
+
var privEl = document.getElementById('privilege-input');
|
|
748
|
+
if (privEl) privEl.addEventListener('keydown', function(e) {
|
|
749
|
+
if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); runPrivilegeDemo(); }
|
|
750
|
+
});
|
|
751
|
+
</script>
|
|
752
|
+
</section>
|
|
753
|
+
</main>
|
|
754
|
+
|
|
755
|
+
<footer class="footer">
|
|
756
|
+
<p>ThumbGate is a software control layer, not legal advice. This page is intended for pilot scoping with law-firm innovation, technology, risk, and pricing teams. Final policy choices should be reviewed by the firm's attorneys and security team.</p>
|
|
757
|
+
</footer>
|
|
181
758
|
</div>
|
|
182
759
|
</body>
|
|
183
760
|
</html>
|