Agentic Legal AI: Who Controls the Orchestrator Layer?

Three major legal AI vendors have now shipped multi-agent orchestration as their flagship architecture inside the same twelve-month window. Thomson Reuters built Deep Research into CoCounsel. LexisNexis rebuilt Protégé around a four-agent pipeline. Harvey opened its Agent Builder to let firms assemble their own autonomous chains. That's not a coincidence of product roadmaps — it's a signal that "agentic" has stopped being a differentiator and become table stakes, the way "cloud-based" was in 2015 and "has a chat interface" was in 2023.

For managing partners and CIOs evaluating these tools, the convergence changes the diligence question entirely. When every vendor demo looks similar — a query comes in, agents plan, retrieve, draft, and verify, and a polished answer comes out — the differentiator is no longer what the system does. It's where it runs and what leaves your environment while it's running. That's the question this month's agentic AI infrastructure briefing surfaces, and it's the one most procurement processes still aren't asking with enough precision.

The Convergence Is Real — and It's Happening Fast

Look at the pattern across the three vendors driving this cycle:

• CoCounsel Deep Research (Thomson Reuters) chains together research, synthesis, and drafting steps autonomously, pulling from Westlaw content and firm-connected document stores across a single multi-stage task rather than requiring a new prompt at each step.
• Lexis+ Protégé's four-agent orchestration splits work across specialized agents — commonly described internally as research, drafting, review, and citation-verification roles — that pass outputs to one another before returning a final work product to the attorney.
• Harvey Agent Builder goes further, giving firms a visual canvas to construct their own custom agent chains, wiring together document review, extraction, and drafting steps specific to a practice group's workflow.

The common thread: all three moved from "ask a question, get an answer" to "delegate a task, get a workflow." That shift matters practically. A single-query tool touches one prompt's worth of context. A multi-step agent workflow might execute 10-30 discrete actions per task, each one a potential retrieval, tool call, or API hop. According to RAGbase's October 2026 survey of AmLaw 200 technology leads, 68% said they could not fully describe where intermediate agent outputs — the scratch-pad reasoning and interim drafts generated mid-workflow — are stored by their primary vendor. That's not a criticism of any single product. It's a structural byproduct of how fast agentic architecture has been adopted industry-wide, often outpacing the security documentation that normally accompanies a platform of this complexity.

What "Agentic" Actually Changes About the Risk Calculus

The shift from single-query tools to agentic workflows isn't incremental — it changes the risk surface along three dimensions that legal IT and risk committees haven't had to model at this scale before.

First, orchestration state. A multi-agent system has to remember what it's done across steps — which documents it pulled, what the drafting agent produced, what the verification agent flagged. That state has to live somewhere. If it lives on vendor infrastructure, the firm's workflow logic and intermediate work product are now persisted outside the firm's control, even if the final answer is deleted.

Second, connector sprawl. Agentic workflows are valuable precisely because they reach into DMS systems, email, case management, and research databases autonomously. Each connector is a new data path. A four-agent pipeline touching three connected systems has meaningfully more potential egress points than a chatbot answering from a single uploaded PDF.

Third, permission inheritance. When an agent acts on a lawyer's behalf — pulling a privileged memo, cross-referencing a conflicts database — whose permissions govern that action, and is the access logged with enough granularity to reconstruct it during a malpractice inquiry or a regulator's request? Static role-based access control, designed for humans clicking through a DMS, often doesn't map cleanly onto an autonomous agent chaining six actions together in two seconds.

None of this means agentic AI should be avoided. The productivity case is strong — firms piloting multi-agent research and drafting workflows report cutting first-draft turnaround on complex memos from days to hours. But the architecture question has to be asked explicitly, because the vendor demo won't surface it on its own.

Three Questions Every Buyer Should Be Asking in 2026

Based on the agentic AI infrastructure patterns surfacing this quarter, three questions separate a defensible procurement decision from one that looks fine in the demo and raises uncomfortable questions in a privilege dispute eighteen months later.

1. Where does the orchestrator physically run?

Is the agent-planning logic, the step sequencing, and the tool-calling layer executing on vendor-hosted multi-tenant infrastructure, a dedicated single-tenant instance, or the firm's own environment? This is different from asking where the LLM runs — the orchestrator is the layer deciding what to retrieve, what to call, and what to pass forward. It's the part of the system with the most visibility into a matter's full scope.

2. Who holds the permissions and the logs?

If an agent pulls a document, drafts a clause, and discards an intermediate version that referenced privileged strategy, where is the record of that action, and who controls retention and deletion? Firms need an answer more specific than "we're SOC 2 compliant." The real question is whether the audit trail — down to individual tool calls — sits in a system the firm's own security team administers, or one it has to request exports from.

3. How much raw document content actually leaves the firm's environment?

This is the one most vendors answer imprecisely. Every agentic system eventually has to send something to an LLM to generate language. The question is whether that "something" is a tightly scoped, minimally necessary chunk of text, or whether broader context — full documents, prior conversation history, connector metadata — is routed through vendor-hosted infrastructure as part of normal operation.

A Structural Comparison

The distinction in that last row is the one worth sitting with. It is not "shared-cloud vendors send your data out, RAGbase never does." RAGbase also uses commercial LLM providers — Anthropic, OpenAI, or whichever model a firm selects — because frontier reasoning quality still comes from those models. The honest difference is architectural: the full document corpus, the agent scaffolding, the workflows, the connectors, and the logs stay inside the firm's infrastructure. Only the minimal retrieved chunks needed to answer a specific step go to the LLM, under the firm's own API terms. That's a materially smaller and more controllable data path than routing the entire orchestration layer through a vendor's shared environment.

Why the Orchestrator Location Matters More Than the Model Choice

Most procurement conversations in 2024 and 2025 fixated on which foundation model a vendor used — Claude, GPT-4, Gemini — as if that were the primary risk variable. The agentic shift exposes why that framing was incomplete. The model only ever sees what the orchestrator sends it. If the orchestrator lives in the firm's own environment, the firm controls exactly what gets passed to the LLM, can audit every call, and can swap providers without re-architecting anything. If the orchestrator lives with the vendor, the firm is trusting a third party's internal engineering decisions about chunking, context windows, and retention — decisions that are rarely documented at the level of specificity a GC needs for a privilege log or a cross-border data transfer assessment.

This is precisely why private AI deployment has moved from a niche request to a standard RFP line item at firms handling regulated, cross-border, or litigation-sensitive matters. It's not a rejection of agentic AI — it's a recognition that the orchestration layer, not just the model, is now the thing that needs to sit inside the firm's security perimeter.

Where This Shows Up in Practice

Consider a mid-size litigation team running an agentic research workflow across a document-heavy antitrust matter. A shared-cloud agent might pull from connected repositories, run several research and drafting passes, and return a memo — all orchestrated on vendor infrastructure, with the full set of pulled documents transiting that layer at some point in the process. The same workflow under a firm-hosted orchestration model keeps the document set, the retrieval index, and the agent's intermediate steps inside the firm's own environment, including the same case search capability firms already rely on for research — and sends only the specific passages needed to answer each sub-question to the LLM. The end product looks similar. The data path and the audit trail do not.

What This Means for 2027 Procurement Cycles

As agentic architecture becomes the default rather than the differentiator, RFPs are starting to shift accordingly. Firms that spent 2024-2025 asking "which model does this use" are now asking "show me the orchestration diagram" and "export me a full audit log from a real multi-step task." That's a harder question for shared-cloud vendors to answer with full transparency, because the orchestration layer is typically core, proprietary infrastructure they're not built to expose at the architecture-diagram level.

It's also prompting a more nuanced vendor strategy inside firms: agentic tools for lower-sensitivity, high-volume work where speed and ecosystem integration matter most, paired with a firm-controlled architecture for matters where the orchestration layer itself — not just the final output — needs to stay inside the firm's perimeter. That's a segmentation decision, not an all-or-nothing platform bet, and it's one more CIOs are formalizing into their 2027 technology roadmaps rather than leaving to ad hoc pilot approvals. Our AI for law firms guide walks through how to structure that segmentation across practice groups without duplicating tooling spend.

The agentic shift is real, it's accelerating, and it's producing genuinely useful workflows across the market. The diligence that matters now isn't whether a vendor has agents — virtually all of them do. It's whether you can draw the architecture diagram yourself, point to where the orchestrator and the logs actually live, and name exactly what leaves your environment on a given query. If you can't get a straight answer to those three questions from your current or prospective vendor, that's the conversation worth having before the next contract renewal, not after an incident forces it.