How Do You Build a Content Safety Wrapper?
A brief-advice tool can give a fluent, accurate-sounding answer that is wrong for the person in front of it. The content safety wrapper is the cohort's response: a layer that sits around the content and decides, for each kind of legal situation, whether to answer, what to ask first, and when to route to a human. This guide is how it works, how experts built the starter version, and how to build your own. It is honest about what is built and what is still unproven.
Common Legal Help AI. Working draft for comment. Margaret Hagan, Stanford Legal Design Lab.
The wrapper started from two failure modes that Siobhan Durcan named. The first is the Frankenstein problem: when a system stitches retrieved content together, it can pull a step away from the warning or the deadline that qualifies it, so the answer reads clean and drops the part that mattered. The second is the confident answer that does not know the facts that would change it, an answer about eviction that does not know whether the person has been served, or whether the housing is public or private. The wrapper is built to address both. It keeps disclosures attached to the content they qualify, and it makes the system ask the questions that change the answer before it gives one.
How it works
Every legal situation, keyed to a LIST code and a scenario, carries a safety profile. The center of the profile is a risk tier, and there are four. Green means the answer is unlikely to mislead even without knowing much about the person, so the system can synthesize a tailored answer. Yellow means the answer depends on the person's situation, so the system verifies the key variables and surfaces caveats. Yellow-High means the consequences of a wrong answer are serious, so the system asks clarifying questions aggressively before it answers at all. Red means a wrong answer risks physical danger or irreversible legal harm, so the system does not synthesize a personalized answer: it gives general orientation and routes to a human with a real referral.
Around the tier, each scenario carries three more things. Key variables are the facts the system must know before answering, and when they are unknown, they become the clarifying questions the system asks first. Escalation triggers are the situations that override the normal flow and hand off to a person, an active emergency, criminal exposure, an irreversible step about to be taken, a safety risk. Must-travel-with links are the content items that have to be retrieved together, so that a filing step always arrives with its deadline. At retrieval time the system reads the profile and behaves accordingly, and when a content item maps to two scenarios, the most restrictive profile wins.
How experts built the starter set
The cohort built a starter wrapper over 150 priority issues. The draft was auto-populated first: tiers and escalation triggers guessed from keywords, key variables pulled from the existing scenarios. Then it went to people. Domain experts reviewed fifteen to twenty scenarios each, at five to ten minutes apiece, which is fast because an experienced attorney already knows the key variables for eviction or for a protection order. Per scenario they did five things: confirm or change the risk tier, write or refine the key variables, add the must-travel-with links inside their domain, confirm the escalation triggers, and flag any scenario to split or combine. A separate cross-domain session caught the links that cross practice areas, custody to domestic violence, eviction to rental assistance, reentry to employment and housing. The draft landed at roughly 122 Yellow, 7 Yellow-High, and 21 Red. You can see the current scenarios, and how each is tagged with its tier, variables, and warnings, in the live draft wrapper.
How to build your own
Tag your content to scenarios. For each scenario, assign a tier, list the key variables, set the escalation triggers, and link the content that must travel together. Store the profile as metadata that travels with each content item when your system retrieves it. A simple version is enough to start: a small block of safety metadata attached to each item, which any retrieval system can read. The fuller version, for scenarios where a guided interview already exists, is a rule file that encodes the whole decision tree, which variable changes the path and where the stops and escalations are. Put your own experts on the review, an hour or two per domain cluster, and use the starter set as a model rather than starting from a blank table.
Two ways to tag, and why you want both
There are two ways to make a system safe on hard content. One is to throw everything at the model: give it long context, break the question into sub-questions, and tune until it passes a thousand evaluations. That produces a system that performs well on average. The other is to put a deterministic layer on top of the content: a small set of rules, written by the people who wrote the content, that always fire. A well-tuned model can still drop the warning that mattered on the one query that did not look risky. The deterministic layer is what removes that residual risk, the last few percent a performance-tuned system leaves behind. The wrapper uses both: the model for the answer, and rules that always attach the warning and always ask the follow-up.
This is also why the wrapper is not aimed at hallucination. Hallucination rates are already low, and no system stops them completely. The failures the wrapper guards against are different: an answer that is fluent and free of hallucination yet still wrong, because it misunderstood the situation, ran on too little context, or stitched content together and dropped a caveat. Those are the failures a deterministic layer can catch and a better model cannot promise to prevent.
What the work looks like, and what it costs
Tagging content this way takes real effort, though less than people expect. It starts with a workshop. Get the content people, the knowledge experts, and someone from the digital side in the same room, because the goal is to surface what an experienced writer does without being told: the warnings, caveats, and linked lists they always include. Spend a half day naming, for your own setting, the best way to identify those. After that it gets faster. You move to automatically tagging the pieces of information on a page, and the reviewers' job becomes validation: confirming the warnings, caveats, and lists the system pulled out. Technically, the change is made where you already chunk your web content for retrieval, so the wrapper is a layer on top of that pipeline rather than a separate build. The bar has to stay low enough that an organization can afford to do it, and this is not work for every content type. Reserve it for the content where a misunderstanding does real harm.
Where the key questions come from
The key variables for a scenario, the questions the system must ask before it answers, are usually written down somewhere already. They live in the decision trees your team has built, in the guides advisors use for asking the right questions, in the regulations that require certain questions before advice is given, and in the case notes and transcripts of real conversations. The test is simple: if you would advise someone on this topic, what would you ask them first? Those questions, the ones a careful advisor in any jurisdiction would ask back before answering, are the scenario's key variables, and labeling them is the heart of the work.
There is a shortcut for the evaluation side. You already hold the documents your advisors follow, so generate your evaluation questions from those. The required questions and the required information in an advice guide map directly onto what the system must elicit and what a good answer must contain. For any piece of content you hold, the labeling task is to extract and tag the things that have to survive retrieval: the warnings, the caveats, and the linked lists that carry a procedure. Those are exactly what an AI synthesis tends to lose.
Standing behind it: assurance and communication
A deterministic layer is also what lets an organization stand behind the tool. The questions that decide whether you can deploy are not only about information security and privacy. They reach professional indemnity: what an organization is insured to put in front of a vulnerable person who will act on it. The answer that holds up is a fallback that does not depend on the model's behavior on a given day. The system always shows the warning, always asks the follow-up question, and always applies the same rules its content designers wrote. That is something an organization can evidence and insure, in a way that "the model passed our tests" is not. And because people want an answer and will act on it, the wrapper has to communicate its limits in plain language: when a situation is more complex than it looks, say so, and point the person to a human.
What is built and what is not
This is a design, a starter set of scenarios, and a method for getting expert input. What is not yet proven is the thing that matters most: whether a system that uses the wrapper actually produces safer, more situationally appropriate answers than a well-prompted system without it. The test is designed and not yet run. It compares the same content run two ways, with the wrapper and without, scored against a scenario matrix by expert reviewers. Until that evidence exists, build the wrapper as a guardrail rather than a guarantee, expect to test it on your own content, and keep a person in the loop on the Red and Yellow-High situations no matter what the tier logic says. The wrapper also assumes the underlying content is accurate and current. It is a layer on good content, not a substitute for it.