Box Legal Workflows

Shared Legal Concepts

PREREQUISITE: Use the box skill for Box MCP authentication, tool selection, and base workflows. If it is not installed, run: npx skills add https://github.com/box/skills --skill box

Shared building blocks used by the legal skills (M&A, Intake, Contract Review): Box collaboration role definitions, the boundaries of where Box AI must not be the decision-maker, and reusable confirmation phrasings. Risk frameworks, metadata fields, workflows, and decision-transparency requirements live in the individual legal skills.

Box capability references

Reach for these for the underlying Box tool mechanics rather than restating them here:

• The box skill's references/collaboration.md — collaborator role capabilities, shared links, and external-sharing rules
• The box skill's references/ai-and-retrieval.md — Box AI Q&A, extraction, and structured metadata tools, with pacing/limits/citations

Box Collaboration Roles

[CONFIRM: What permission level is appropriate?]

For the full breakdown of each Box collaborator role (Co-owner, Editor, Viewer Uploader, Previewer Uploader, Viewer, Previewer, Uploader) and the exact capabilities each grants, see the role matrix in the box skill's references/collaboration.md. Use that matrix to determine which role fits a given collaborator, then have the human confirm the choice before granting access.

Apply least privilege: default to the most restrictive role that still lets the collaborator do their job, prefer specific folders over root access, and set expiration dates on external collaborations.

Box AI Boundaries

Box AI informs; a human attorney decides. Do NOT use Box AI for:

• Final legal advice or decisions (human attorney only)
• Access-control decisions (human approves permissions)
• Client conflict checks (use the firm's conflict system)
• Privilege determinations (attorney judgment)
• Settlement negotiations or strategy

Box AI is appropriate for informing humans — completeness checks, risk-factor flagging, metadata extraction, contract comparison, and due-diligence Q&A — always with citations surfaced and a human making the final call.

For details on the Box AI tools available and how to use them, see the box skill's references/ai-and-retrieval.md.

Common Confirmation Patterns

Reusable phrasings for the human-in-the-loop confirmations the legal skills require.

Risk Rating

"Here are the factors I found: [...], with citations from Box. Under your firm's criteria, which rating applies?" (The agent presents facts; the firm's criteria and attorney determine the rating.)

Permissions

"I'll grant [person] [role] access to [folder/file]. They can [permissions]. Proceed?"

Routing

"Based on [practice area/risk/type], I recommend routing to [attorney]. Correct, or assign to someone else?"

Document Completeness

"Firm requires: [list]. Found: [list]. Missing: [list]. Proceed with assessment?"

Metadata Template

"Do you have a Box metadata template for [type]? If yes, scope and template key?"

Thresholds

"What is your firm's threshold for [matter value/expiration alert/risk escalation]?"

External Sharing

"Before sharing with [external party], confirm: (1) Permission level? (2) Folders? (3) Expiration? (4) Link or collaboration?"