Firm control: what the firm's rules enforce today, the engines it permits per surface, its house voice, and what no setting moves

Current availability

Capabilities

• ShippedThe floor no setting moves, read from its registries: the acts that always show a receipt and need a single-use approval, the pages and doors that need the second factor, and the notification floors.
• ShippedThe AI engines, permitted per surface: Opus 5 always on; the firm may turn ChatGPT 5.6 Sol and Fable 5 off on the drafting workstation, for workspace runs and in the grounded lane — each separately. The lane grant and the drafting, workspace and grounded routes refuse a turned-off engine before any model is called, and each surface's picker says the firm turned it off.
• ShippedWhat each model vendor has declared about keeping requests, shown as declared — the vendor's own sentence, its date and its reference — never as observed; none is shown until one is recorded.
• ShippedThe house voice: the firm's register, sentence length, hedging, preferred terms (write this, not that) and prohibited terms, with each attorney's own voice over it. A draft is written in the voice of the matter's assigned attorney (else of the attorney running it) — the drafting workstation's drafts and the grounded lane's drafts and redlines. An attorney's prohibited terms join the firm's and never remove one; a preferred term the firm prohibits is left out.
• ShippedThe voice shapes wording only: it is written into the drafting prompt after the hard bounds, which it relaxes none of, and the validator that enforces the allowed citations, verbatim statute text and the client's dispositive text reads nothing from it. Every finished draft is checked for the prohibited terms; the reviewing attorney sees each one found and where — one inside approved clause text is kept there, never rewritten.
• ShippedThe firm's switches, each only taking something away and each read by the code it names (a census test refuses an undeclared one): the public consult door — closed, the page says so in the visitor's language and the door and the database refuse a new request.
• ShippedThe record: every change to every switch and voice is a new version with who, when and why — a row is never edited — and every change is audited strictly.

Limits

• Opus 5 cannot be turned off, and no switch turns on anything the platform has not already turned on.
• The voice is style, never law: a prohibited term that approved clause text or verbatim statute text carries stays in the draft and is flagged; the voice cannot remove a citation or change a client's facts.
• A voice that cannot be read when a draft runs is said so on that draft's record — the draft is written without it, never in a guessed voice.
• The firm's other rules keep their own pages (disclosure, retention and holds, walls, conflicts, keys); this page links to them.
• A firm administrator changes a switch and sets the house voice and any attorney's; an attorney sets their own; the rest of the staff read it.

What EstateDraftFL refuses

Evidence

• supabase/migrations/20260929020000_phase10d_firm_policies.sql
• src/lib/firm-control/policies.ts
• src/lib/firm-control/server.ts
• src/lib/firm-control/voice.ts
• src/lib/firm-control/voice-server.ts
• src/lib/generation/drafter.ts
• src/lib/grounded/operations.ts
• src/app/api/admin/firm-control/route.ts
• src/components/firm-control/FirmControl.tsx
• src/components/firm-control/FirmVoiceSection.tsx
• src/lib/workspace/grant.ts
• docs/security/MASTER-PLAN-PHASE10D-2026-09-29.md

Last reviewed 2026-09-29