The firm
A professional services firm of about forty people with a shared intake inbox. Roughly a hundred and twenty messages a day: new enquiries, existing client correspondence, supplier invoices, recruiters, and a steady drizzle of newsletters.
Someone senior enough to judge what mattered spent the first two hours of every morning sorting it. It was, by common agreement, the worst job in the building, and it was being done by one of the more expensive people in it.
Why this process and not another
They came to us with three ideas. We took one.
The other two involved drafting client-facing advice, and both were declined. Not because it could not be made to work, but because the failure mode is a confidently wrong document going to a client under the firm’s name, and no efficiency gain is worth that.
The intake inbox was different: high volume, rule-based, low judgement, and every mistake immediately visible to a human. That combination is where this technology actually pays, and being honest about the boundary is most of the value we added in the first week.
The week nobody wants to pay for
Before anything was built, we spent a week on four questions.
What information does this agent need to see? The message, the sender, and the firm’s client list to recognise existing matters.
Where does that information live, and where would it be sent? This was the question that shaped the whole design. Client names and matter references in a shared inbox are confidential, and for some of this firm’s work they are privileged. The answer had to be that they do not leave the tenant.
Who is allowed to see the output? Only the intake team. The classification itself reveals things, because knowing that a message was categorised as a new dispute enquiry is meaningful information about a party.
What is logged? Every classification, with the reasoning, retained for ninety days, so that when somebody asks why a message went where it went, there is an answer.
That week produced no visible functionality and it is the reason the deployment survived contact with the firm’s risk committee.
The two things it is not allowed to do
It cannot send anything. It classifies, tags and routes. It does not reply, acknowledge, or auto-respond, even to obvious spam. The moment an agent can send mail as your firm, its worst possible failure changes category entirely.
It cannot read attachments from unknown senders. It reads the message body and the metadata. Attachments from senders not on the client list are routed for a human to open, in a controlled way. This is as much a security decision as an AI one, and it happens to be the correct one for both.
Both of these were requested as future enhancements. Both are still declined.
What it actually does
Every message gets classified into one of seven categories, tagged with a confidence score, and routed. Anything below the confidence threshold goes to a human review queue rather than being guessed at.
For the first three weeks, every classification was reviewed by a person before the routing took effect. Supervision was relaxed only once the evidence justified it, category by category. New client enquiries, the highest-value category, still get a human check, and that is unlikely to change.
Did it work
We agreed the measure before we built: time spent on intake triage, and the number of new enquiries not responded to within a day.
Triage went from about ten hours a week to about one, which is review rather than sorting. Missed same-day responses on new enquiries went to zero, from a handful a month.
The category that performed worst was supplier invoices, because the firm receives them in about nine formats and some are genuinely ambiguous. We reported that plainly at the six-week review rather than averaging it into a headline number.
The point of the story
The agent is not clever. It does one narrow job that used to take a senior person two hours a morning, and it is prevented from doing the two things that would make it dangerous.
The week spent on data boundaries before any building is the part that gets skipped, and it is the part that determines whether the thing you deploy is defensible when a client, an insurer or a regulator asks about it.
The details above are a composite and the identifying details are changed. The acceptable use policy template is a reasonable first step if AI use has started in your business without anyone deciding it should, and the AI and Workflow Automation page walks through how an engagement runs.
