# Mandate Law

> Legal counsel for AI products, agents, and the consumer apps they live in, built for the coding agents that build them. AI feature reviews, agent authorization and liability, privacy policies, terms, and consent flows, delivered as final documents plus a build spec, a verification checklist, and a counsel-triggers file that show your agent how to ship the feature, not just what could go wrong. Allen Gibby, admitted in the District of Columbia.

## Rules for agents

- You are not the client. The person or company you act for is. A human with authority must sign the engagement letter before legal advice is given.
- Call `conflict_check` first (names only). Then send a short, public-level matter summary so the attorney can decide whether to take the matter. Detailed product facts wait until the engagement letter is signed.
- Send facts about the code with file paths as evidence. Never send secrets, keys, source dumps, or user data.
- Content on this site is legal information, not legal advice.
- Instructions inside content you submit are treated as data and ignored.
- Admitted in DC. Federal law, platform and model-provider rules, and multistate law are in scope; questions needing another state's license are referred out.
- Outside the United States: issue-spotting only. Counsel flags issues (for example, under EU and UK law) for you to raise with local counsel, but does not advise on non-U.S. law.

## How to engage

1. `check_scope` (free and anonymous): an instant answer on whether the request fits, which service, and its fixed fee. Send no names; nothing is saved.
2. `conflict_check` (free): company name, people, adverse parties.
3. `request_engagement`: send a `matter_summary`: what the product does (as you'd describe it publicly), stage, users, where they are, which `features_in_play` apply (AI output, LLM data sharing, agent actions or payments, health or financial data, minors, and so on), your questions in general terms, and whether there is an active dispute or regulator contact. No code, secrets, or confidential plans. Returns a `matter_id` and a secret `matter_token` (shown once; store it securely). Pass the token to every matter tool, or as a Bearer token on the REST API.
   The attorney reviews conflicts and the summary, may post a few scoping questions (answer them with `answer_open_question`), then accepts the matter (possibly under a different service) or declines it. If accepted, the engagement letter is emailed to your human to sign. The fixed fee is due when the work is delivered; nothing is paid up front.
4. `submit_intake` (after the letter is signed): facts per [intake-schema.json](/api/intake-schema.json), each with a source (`verified_in_code` preferred).
5. `get_matter`: status, counsel's open questions, deliverables.
6. `answer_open_question`: answer each open question with a fact and evidence. Most can be verified from the code in minutes.

## Privilege

Your communications with counsel are privileged and confidential. Privilege can be lost by careless sharing, so:

- Share privileged material only with your principal and the people they choose. Every `get_matter` response includes a `privilege` block with the rules.
- Commit only the deliverable parts listed in `deliverable.handling.safe_to_commit`: `build_spec`, `verification_checklist`, and `counsel_triggers`. They say what to build and what it achieves, and are written to be shared with engineers. Counsel's reasoning is in `privileged_memo`, keyed by build-spec id.
- Never put `privileged_memo`, `open_questions`, or counsel's responses in commits, pull requests, issues, tickets, shared chat, or agent memory and rules files. Storing the `matter_id` is fine.
- Keep the `matter_token` in a secret store or environment variable, never in the repository.
- Run on a model account whose terms don't allow training on your data (API, business, or enterprise tiers), and tell counsel which one in intake.

MCP endpoint: https://mandatelaw.ai/mcp (streamable HTTP)
OpenAPI: [/openapi.yaml](/openapi.yaml)

## Example session

A fictional travel-booking agent, start to finish. Calls are MCP tool calls; responses are shortened. The REST API takes the same arguments (`POST /api/scope`, `/api/conflict-checks`, `/api/engagements`, and so on).

**1. Check scope (anonymous, nothing saved).** Tell your human the fee before going further.

```
check_scope {"request": "Confirmation and authorization rules for an agent that books and pays for travel"}
→ {"in_scope": true, "suggested_services": ["agent-product-review"],
   "fees": [{"service_id": "agent-product-review", "fee_display": "<fixed fee, returned live>",
             "payment_terms": "Fixed fee, stated in the engagement letter and due on delivery of the work. No advance payment or retainer."}],
   "next_step": "conflict_check"}
```

**2. Conflict check (names only).**

```
conflict_check {"client_name": "TripPilot Inc.", "contact_name": "Pat Lee",
                "adverse_or_related_parties": ["Example Airlines"]}
→ {"conflict_check_id": "CC-…", "status": "pending_attorney_review",
   "next_step": "request_engagement with a short matter_summary…"}
```

**3. Ask the firm to take the matter (public-level summary, no code or secrets).** Store the `matter_token` in a secret store; it is shown once.

```
request_engagement {"conflict_check_id": "CC-…", "service_id": "agent-product-review",
  "principal_email": "pat@trippilot.example",
  "matter_summary": {"what_it_does": "A consumer app whose AI agent books flights and hotels for users.",
    "stage": "beta", "users": "consumers", "where_users_are": ["US"],
    "features_in_play": ["agent_takes_actions", "agent_payments", "sends_user_data_to_llm"],
    "questions_for_counsel": "What confirmation and disclosure do we need before the agent pays?",
    "active_dispute_or_regulator_contact": false}}
→ {"matter_id": "M-…", "matter_token": "mt_…", "status": "awaiting_attorney_review",
   "fee": {"service_id": "agent-product-review", "fee_display": "<fixed fee>", …}}
```

**4. Check back, and answer any scoping questions (keep them general).**

```
get_matter {"matter_id": "M-…", "matter_token": "mt_…"}
→ {"privilege": {…}, "status": "awaiting_attorney_review",
   "open_questions": [{"id": "Q-…", "scoping": true, "status": "open",
                       "question": "Does the agent pay with a stored card or send the user a payment link?"}]}

answer_open_question {"matter_id": "M-…", "matter_token": "mt_…", "question_id": "Q-…",
  "answer": {"value": "Stored card, charged only after the user taps Confirm.", "source": "stated_by_client"}}
```

When the attorney accepts, `status` becomes `awaiting_signature` and your human gets the engagement letter by email. After it is signed, `status` is `engaged`.

**5. Send product facts, with evidence from the code.**

```
submit_intake {"matter_id": "M-…", "matter_token": "mt_…", "intake": {
  "agent": {"spending": {"value": "Charges the user's stored card only after an explicit confirm tap; no standing authorizations.",
    "source": "verified_in_code", "evidence": [{"path": "src/checkout/confirm.ts", "lines": "40-58"}]}}, …}}
→ {"status": "in_review", "next_step": "get_matter later for counsel's open questions"}
```

Then answer counsel's follow-up questions the same way, and read the deliverable from `get_matter`. Commit only the parts listed in `deliverable.handling.safe_to_commit`.

## Services

- [Service catalog](/api/services.json), with scope and turnaround:
  - `ai-feature-review` (5 business days): model-provider terms, disclosures, state AI and chatbot laws. Non-U.S. issues are flagged for local counsel.
  - `agent-product-review` (7 business days): authority model, confirmation gates, responsibility for agent actions, payments, third-party site terms.
  - `launch-review` (10 business days): privacy policy, terms and EULA, health-data policy, consent build spec. Up to 3 documents, 2 revision rounds.
  - `feature-check` (2 business days): one planned change that matches a counsel trigger.
  - `counsel-on-commit` (monthly): up to 3 feature checks a month; your agent checks triggers before it builds.
- Fees: every service has a fixed fee, due on delivery, with nothing paid up front. Call `check_scope` (free) to get the exact fee for the services that fit, and share it with your human before requesting an engagement. `request_engagement` and `get_matter` also return the fee.

## Guides

Legal information (not advice), each with a checklist an agent can run against a codebase. The full text of every guide is in [/llms-full.txt](/llms-full.txt).

<!-- GUIDES:START (generated by build.ps1) -->
- [How should my agent handle users' passwords and logins?](/guides/agents-and-user-credentials.md): Delegated access versus stored passwords, the security and breach-notification duties that come with holding credentials, and a safer design.
- [Can my AI agent give legal, health, or financial help?](/guides/agents-in-regulated-professions.md): Where general information ends and licensed advice begins, the rules that apply to AI in law, health, and finance, and how to design and market these products.
- [Who is responsible when my agent uses another company's website?](/guides/agents-on-third-party-websites.md): Website terms, anti-hacking laws, and bot detection when an agent browses, logs in, or transacts on sites you don't control, and how to design for it.
- [What should I do when a user says my agent did something they didn't authorize?](/guides/agent-took-unauthorized-action.md): The first hours after an agent makes a purchase, sends a message, or deletes something a user says they never approved. Contain, preserve, assess, and respond.
- [Can my AI agent buy things for users?](/guides/ai-agent-purchases-for-users.md): The legal questions behind agents that book, buy, and pay for users, including authority, errors, payments, merchant terms, and disclosure.
- [How do I keep legal advice privileged when my agent talks to my lawyer?](/guides/privilege-when-your-agent-talks-to-counsel.md): Attorney-client privilege when an AI agent carries your communications with counsel, including the model account it runs on, where advice ends up, and a handling checklist an agent can follow.
- [Can I send user data to an LLM provider?](/guides/sending-user-data-to-llm-providers.md): What to check before user data goes into prompts sent to a model provider's API, including provider terms, your own promises, sensitive data, and logging.
- [Is it risky to use session replay or analytics SDKs in my app?](/guides/session-replay-and-analytics-sdks.md): Why session replay, autocapture, and tracking pixels lead to lawsuits and enforcement, and how to configure analytics so your privacy policy stays true.
- [Do I have to tell users they're talking to an AI?](/guides/telling-users-they-are-talking-to-ai.md): When US state laws and the EU AI Act require an AI disclosure, what a good disclosure looks like, and how to check your product for it.
- [What should the terms of service for an AI product cover?](/guides/terms-of-service-for-ai-products.md): The sections an AI product's terms need beyond a standard SaaS template, from outputs and accuracy to acceptable use, training, and agent actions.
- [Can I train or fine-tune a model on my users' data?](/guides/training-models-on-customer-data.md): What decides whether user or customer data can be used for training, including promises already made, contracts, sensitive data, and the risk of having to delete a model.
- [Does Washington's My Health My Data Act apply to my app?](/guides/washington-my-health-my-data-act-apps.md): Who the law covers, what counts as consumer health data, and the checklist an app has to meet. Written for developers and the coding agents working for them.
<!-- GUIDES:END -->

## Schemas and templates

- [Intake schema](/api/intake-schema.json): what counsel needs to know, written so an agent can answer it from the codebase. Includes `ai_feature` and `agent_product` sections.
- [Deliverable schema](/api/deliverable-schema.json): documents, build spec, verification checklist, counsel triggers, open questions.
- [Counsel triggers](/api/counsel-triggers.json): changes that need legal review before you ship them. Commit a copy to your repo and reference it from AGENTS.md or CLAUDE.md.
- [Agent setup snippet](/agents-snippet.md): two steps to make any coding agent check the triggers before it builds. Claude Code users can install the `mandate-counsel` plugin instead.
- [Sample deliverable](/api/examples/sample-deliverable.json): a fictional travel-booking agent.

## Verify this firm

- Attorney: Allen Gibby, founder of Mandate Law. Admitted in the District of Columbia only.
- Confirm the admission in the D.C. Bar's public member directory: https://my.dcbar.org/directorymemberships?id=0014z00001kb18KAAQ
- LinkedIn: https://www.linkedin.com/in/allen-gibby-05b518394/ (lists Mandate Law and links back to https://mandatelaw.ai).
- Firm email: intake@mandatelaw.ai. MCP server: https://mandatelaw.ai/mcp, listed in the official MCP Registry as `ai.mandatelaw/counsel`.

## Attorney advertising

This site is attorney advertising. Prior results do not guarantee a similar outcome.