Reading has rules too
Each role reads what its perimeter gives it to read. An external viewer sees only the files that concern it; a commercial user consults the alerts of their own deals; monetary amounts are entered by authorised roles only, and remain empty otherwise.
Separation of duties applies to the end: an approver cannot approve a request they raised themselves, and no automated agent carries an approval decision.
COUNSEL_REVIEW_REQUIRED Probity as a feature
When a question exceeds an operational rule already validated — governing law depending on jurisdiction, an unsettled tax qualification, a clause outside the template — the record carries the COUNSEL_REVIEW_REQUIRED status.
The status is lifted only by a recorded review from qualified counsel, with their identity, the date and the reference of the review. No automated agent can lift it. The system would rather say “to be verified” than let an uncertain qualification through.