Jason Lemkin ran the cheapest red team in AI and published the receipt. SaaStr lifted the core prompt out of one vendor's agent, pasted it into a competitor's model, spent a few days tuning, and had a working replacement. His verdict, in the SaaStr post that named the problem: "Your AI isn't your moat. Your AI is table stakes." His advice was to build stickiness beyond the prompt, because "your prompt layer is portable."
Every other industry that read that post still holds a second line of defense. When the prompt layer walks out in an employee's head, the employer reaches for the covenant: the non-compete, the garden leave, the promise not to do over there what you learned to do here. The legal profession struck that instrument from its own rulebook. Rule 5.6 of the Model Rules bars agreements restricting a lawyer's right to practice after leaving a firm, and it has for decades.
Most operators building AI-native legal practices hold a comfortable belief about their process IP, and it is worth stating in their own register: perimeter hygiene plus a legal backstop. The NDAs are signed, the repositories are labeled confidential, and if someone walks out with the system in their head, we have paper and a courtroom. This memo's claim is that in law the backstop does not exist. The covenant is void by professional rule, the trade secret cannot practically be recovered from a memory, and the training program everyone is proudly running transfers the moat into heads that are free to leave with it. Every conventional protection fails in sequence, and what remains is architectural: the boundary around an MSO's orchestration is whatever the product surface shows, and nothing else. The only thing between the moat and the door is what the lawyer was never shown.
1 · Prompts are portable, and law cannot answer
Lemkin's warning lands differently in every industry, because every industry holds a different residual remedy. A hedge fund wraps its researchers in garden leave. A chip designer enforces a non-compete in the states that still allow one. A SaaS company, per Lemkin, builds "stickiness beyond the prompt" in data and integrations. Law is the limiting case: the one profession where the standard contractual answer is void by the profession's own rule.
Two sentences of doctrine, with the guardrail the claim lives on. Rule 5.6 bars agreements that restrict the right to practice; it does not touch confidentiality duties, which survive departure in full. So the precise claim is narrow and sufficient: a legal business cannot covenant the practice, and cannot practically protect what enters a head that is free to practice anywhere. A companion piece in this series will argue that equity aligns the departing lawyer and only the system binds them; this memo asks the prior question, which is what the system must never let into a bindable head at all.
If the covenant is gone, the operator's next reach is trade-secret law. Walk to the courthouse and see what it holds.
2 · The ex-post remedy is a press release
The strongest published case for protecting prompt IP is candid about its own limits. Darin Klemchuk, in a January 28, 2026 firm piece on prompts as the new intellectual property, concludes that trade secret protection "appears to offer the strongest legal framework for prompt libraries," and his prescription is to "restrict access, use NDAs, and label prompt repositories as confidential," with the caveat that protection fails against independent development. Read the prescription twice. Every recommended measure is access architecture. The best legal playbook for prompt secrecy is a set of instructions about what people are allowed to see, which is to say the playbook itself concedes that the working remedy is ex ante and architectural, and that the courtroom is the consolation prize.
Here is why the consolation prize pays so little. Run the hypothetical the structure has to survive: a senior lawyer spends two years inside your orchestration, signs every NDA you put in front of her, and resigns on a Friday. Nothing was downloaded. Nothing was forwarded. The asset's habitat is her memory, because using the system competently every day is indistinguishable from memorizing it. Now bring the misappropriation case. You must prove what was in her head, that it got there improperly or left improperly, and that what she does next uses it rather than her general skill and knowledge, which the law has always let a departing professional keep. And in California, the jurisdiction that wrote two of the authorities on the ledger below, the courts rejected the inevitable-disclosure doctrine outright more than two decades ago, in Whyte v. Schlage Lock: you may not enjoin a departure on the theory that she cannot help but use what she knows. The doctrine that would make the memorized-prompt case winnable is the doctrine the leading AI jurisdiction refuses to adopt. What is left is a lawsuit filed after the leak, proving the contents of a mind, in a forum hostile to the only theory that fits the facts. The ex-post remedy is a press release.
Hold one thought for later, because it is the only place this body of law performs: trade-secret designation will turn out to work exactly once in this memo, and not as a sword. From the courthouse, then, to the surface.
3 · The UI is the license agreement
In software, the license agreement says what the user may see, copy, and reuse. In a legal MSO, the interface has to do that job, because no other instrument survives the sequence above. The design is affirmative, not paranoid: results in, work product out, controls visible, orchestration absent. The lawyer sees the draft, the sources, the checks that ran, the confidence attached, the queue awaiting sign-off. The lawyer does not see the decomposition of the matter into tasks, the routing among agents, the prompt chain, the eval suite that tuned it. The lawyer is licensed to the work, not to the factory. What is never rendered can never be carried out.
The coinage invites its own prosecution, so prosecute it here. A license agreement is a consensual grant, signed by both parties and enforced after the fact by a court. An interface is unilateral self-help: it asks for no signature and waits on no judgment. A hostile reader will say the metaphor smuggles in consent and enforceability it does not have. Both objections are correct, and both are the point. A license is a promise about use backed by a remedy, and the remedy is precisely what the last two sections dismantled: the covenant a court will not honor, the secret a court cannot practically restore. So state the strong form. The interface is the only license agreement that does not need a court to enforce it, and in the one profession where courts will not enforce the alternative, that does not demote it to metaphor. It makes it the only license there is. Its terms are not recited; they are rendered, and its breach is not litigated; it is impossible, because the term and the capability are the same pixel.
But law will not let you build a sealed box, and the reason is the same rulebook that voided the covenant.
4 · The supervision paradox
The profession's answer to AI has been supervision, stated with increasing precision. ABA Formal Opinion 512 (July 29, 2024) applies Rules 5.1 and 5.3 directly: managerial lawyers must establish clear firm policies on generative AI, supervising lawyers must review AI-assisted work product, and the required verification "will necessarily depend on the GAI tool and the specific task that it performs." The State Bar of California's Practical Guidance, revised in 2026 at the California Supreme Court's request to reach agentic AI, is blunter: a lawyer "must exercise independent professional judgment by reviewing, verifying, and correcting AI-generated outputs," and lawyers "remain responsible for reviewing and approving all outputs, decisions, advice, and filings." And the California Bar has proposed amending its professional-conduct rules to require lawyers to verify every AI output · pending as of May 2026, a proposal and not an adopted rule, and it may yet die in committee, but the direction of travel is not ambiguous.
So the same regime that voids the covenant forces the surface open. Supervision, candor, and audit duties require exposing results, controls, and logs; a sealed box is an ethics violation before it is a product. That is the supervision paradox, and it converts the design problem into a single sentence: expose exactly what supervision requires and nothing the orchestration is made of. The duties attach to inputs, outputs, sources, checks, and controls. None of them reaches decomposition, routing, the prompt chain, or the eval suite. Draft the surface to that line, and write the line down. Here it is, written down.
The Exposure Ledger · what the surface owes, row by row
| Duty or demand (authority) | The surface MUST expose | The surface must NEVER expose |
|---|---|---|
| Supervisory review of AI-assisted work (ABA Op. 512, Rules 5.1/5.3) | Work product, inputs as submitted, the sign-off queue | The prompt chain that produced the work |
| "Reviewing, verifying, and correcting AI-generated outputs" (Cal. Bar Practical Guidance, rev. 2026) | Inputs and outputs in full, the edit trail, what changed between draft and filing | Decomposition logic, routing, agent topology |
| Per-output verification (Cal. Bar proposal, pending May 2026 · not adopted) | Citations checked, sources resolved, confidence flags per output | Retrieval strategy, eval suites |
| Firm AI policies and risk training (Op. 512) | Tool identity, data controls, usage logs | The prompt library, the orchestration graph |
| Discovery and court compulsion (sanctions inquiries, malpractice actions) | Whatever the court orders · compulsion pierces every row above | Nothing, as of right. The answer is not refusal; it is a protective order and trade-secret designation under seal |
| Client audit and outside-counsel guidelines | Whatever the OCG specifies and the engagement accepted: tool identity, logs, verification records, review staffing | The orchestration itself · and where an OCG demands it anyway, the engagement is declined or carved, at a price |
One concession belongs in the caption, before a hostile reader supplies it: the left column is law; the right column is policy. Nothing on the right is immune. It is merely never owed, and the design holds only as long as the drafting tracks the duties.
The fifth row deserves its own paragraph, because it is the hardest attack on the entire right column and most treatments of AI confidentiality never say the word. Discovery pierces everything. A sanctions inquiry into a defective filing, a malpractice action over an AI-assisted matter, a fee dispute that reaches the work product: any of these can compel production of the prompt chain no matter what the surface rendered, and an MSO that has not planned for that day has confused containment with concealment. The plan is the one place trade-secret law actually performs, the moment promised in section two. As a sword, recovering the secret from a departed memory, it is nearly useless. As a shield, in discovery, it works: the prompt chain is produced under a protective order, designated as trade secret, filed under seal, attorneys' eyes only, exactly as source code is produced in software litigation every week. Trade-secret law fails the offense and holds the defense, and it holds it exactly once, in the one forum that can force the box open.
The sixth row is the commercial version of the same pressure, and it gets an honest price tag in section six. First, the stakes.
5 · The commodity-skin objection, inverted
A commonplace in consumer software, argued for years and usually correctly, holds that the interface is the commodity layer: skins are cheap, anyone can redraw them, and the durable assets live behind the surface, in contracts, network effects, and proprietary data. In law the stack inverts. The layers behind the surface are precisely the ones this memo has watched fail: the contract is void under 5.6, the data is portable in a head, the network effects belong to the labs. The skin is the only layer with legal force, because it is the only layer whose protections do not depend on a remedy nobody will grant. Elsewhere the interface is disposable because the moat sits behind it; in a legal MSO the interface is the moat's perimeter wall, and everything behind it is load-bearing only so long as it stays behind it. The labs spent the past month raising those stakes: Anthropic shipped Claude for Legal on May 12, 2026, twenty-plus connectors and twelve practice plugins, all available the day it shipped, and on June 1 OpenAI hired Ironclad founder Jason Boehmig to lead its legal vertical, which commoditizes generic legal orchestration from both directions inside a single month · what that pincer does to wrapper pricing is "The Trust Spread Has a Published Closing Schedule" ground, the first memo in this set · and leaves the firm-specific layer, the layer that can walk, as the only proprietary thing left.
Which brings the argument to the person it is about.
6 · The practice pushes back
The strongest objection comes from the lawyer with thirty years in practice, and it deserves printing at full strength:
"You are describing hiding the ball from the lawyer who signs the filing. My name, my license, my malpractice exposure. Opinion 512 tells me to supervise this work and California tells me to review, verify, and correct every output; Rule 1.1, Comment 8 makes the benefits and risks of relevant technology my competence problem, and I cannot competently use what I am forbidden to understand. I can interrogate a paralegal and get answers; your interface refuses interrogation by design. When the client's outside-counsel guidelines or my carrier demand to see inside, your containment is a coverage problem. And when a judge in a sanctions hearing orders me to explain how this brief was generated, 'the MSO will not show me' is contempt, not containment. Clients pay for my judgment; they will not pay for work I supervised through a keyhole."
Every clause is answerable, and two of the answers cost something.
On supervision and the paralegal. The cross-examination point is correct, and the design must absorb it rather than dodge it. A lawyer can interrogate a paralegal; therefore the surface must answer every supervisory question a paralegal could be asked, including every form of why: why this authority, what was checked, what the system was uncertain about, what a human verified and when. What the surface withholds is not the why but the reusable how, the prompt chain and decomposition that would let the answer be rebuilt elsewhere. The test runs in one direction only: if the surface cannot answer a why-question the duty requires, the surface is wrong, not the duty. A keyhole that fails the practitioner fails this memo's own standard.
On competence. Comment 8 requires understanding the benefits and risks of the technology, and that duty runs to the tool's behavior: what it does well, where it fails, what must be checked before signing. It does not run to the vendor's source. A lawyer is competent with legal research platforms without their ranking algorithms and with conflict-check software without its schema; competence with this system means fluency in its outputs, limits, and failure modes, all of which live on the surface by design, because the supervision paradox put them there.
On compulsion. Conceded in full, and the ledger's fifth row is the plan rather than the rebuttal. No one refuses a court. The lawyer ordered to explain a filing explains it, and the MSO's obligation is to make that explanation possible: produce the chain under a protective order, designated and sealed, the way software defendants have produced source code for decades. Containment is a posture toward competitors and departing employees, never toward a tribunal, and an MSO that cannot tell the difference is a sanctions exhibit waiting for a caption.
On guidelines and carriers, the honest cost. Some outside-counsel guidelines demand audit rights that reach the orchestration itself, and those demands are incompatible with containment. Those engagements get declined, or carved so the audit right runs to the verification record rather than the machinery. That is revenue walking away from the design, and the design keeps it anyway, because a moat that liquidates on the first procurement demand was never a moat. Containment is priced, not free, and an operator who says otherwise is describing a client base that does not exist.
And one concession about the floor: it is rising. The 2026 Practical Guidance already says competence "includes understanding system-level characteristics, such as autonomous task execution, retrieval mechanisms, and common failure modes" · language that presses directly on the right column, where retrieval strategy sits. The answer is the same one given to Comment 8, applied honestly: understanding a system's characteristics is fluency in its behavior, and the surface must teach that behavior, including how the system retrieves and where it fails, without handing over the machinery that implements it; where a genuine competence question cannot be answered from behavior alone, the surface opens that far. California's pending proposal, if adopted, would push per-output verification from guidance into rule, and every such move expands the must-expose column. The principle governs the ceiling, not the floor: the surface opens as far as verification genuinely requires, including tracing intermediate reasoning where nothing less will satisfy the duty, and not one layer farther.
7 · The moat-transfer program
The steelman for openness deserves its full strength too, and it is stronger than a training mandate. The upskilling literature, from Comment 8 through the entire CLE genre now marketed as AI skills for lawyers, argues that training depth is not the firm's choice at all: the competence duty forces it, and a lawyer trained only to push buttons is a malpractice plaintiff's dream witness. Opinion 512 itself requires training lawyers and nonlawyers on the tools' risks · an earlier memo in this series, "Privilege Is a Zoning Law for Data," read that opinion for its consent economics; here it sets the training floor. All of that is right, and this memo concedes it without flinching: verification protocols, failure modes, escalation paths, data-handling rules must be taught, deeply, to everyone who touches the system.
But notice what the genre never asks: trained on what, exactly? Train lawyers on the controls and you discharge the duty. Train them on the orchestration and you are running a moat-transfer program: a curriculum that moves the firm's only non-portable asset into heads that Rule 5.6 guarantees can walk, on a schedule set by your own HR calendar. "AI skills training for lawyers" is, in its naive form, exactly that program with a CLE credit attached. The discipline is one line: teach the controls, never the factory. The prompt library, the decomposition logic, the eval suite are not advanced modules; they are the deed to the building, and the competence duty does not require handing it out.
Law arrived at this problem last and arrived at it pure. Other industries can split the difference between contract and architecture, because their contracts are worth something. A legal MSO cannot, which is why it is the one place the design question shows itself whole: every protection that depends on a remedy fails, and the protection that remains is whatever the morning screen does and does not show. The license agreement nobody signs is the one rendered on screen every morning, and its terms are enforced by the only authority that never sleeps and never settles, which is what the lawyer was never shown. The UI is the license agreement. Law is the limiting case that proves it.
Jopese operates a legal MSO, and this memo therefore describes a design problem it owns.
This memo is published by Jopese, a legal management services organization operated by HIRO PARTNERS LLC, a Texas limited liability company. It is offered for educational and analytical purposes only. It is not legal, tax, or investment advice, and it is not an offer to sell or a solicitation of an offer to buy any security or service. Jopese is not a law firm and does not provide legal advice or legal services; legal services are delivered by an independent law firm under a separate engagement in which Jopese does not participate. References to specific companies, publications, ethics opinions, court doctrines, and regulatory developments are drawn from public sources and are provided as market commentary, not as an endorsement, a recommendation, or a representation of any relationship.