Loading insights
Loading insight article
Insights / Production Engineering
Swapping in a better model doesn't fix legal AI hallucinations, the harness around it does. Here's what harness engineering actually means, the five layers a legal AI agent needs, and the real court sanctions that trace back to a missing one.
Legal AI has quietly crossed a line. It's no longer just answering research questions, it's drafting, reviewing and acting on real matters, often with limited human oversight in between. Yet most firms still judge legal AI agents the way they'd judge a search engine: by how smart the model sounds. That's the wrong test. Only 32.1% of legal AI users say they trust the output they get and that's not a capability problem, it's a confidence problem and confidence rarely breaks in the demo. It breaks in production.
What's missing isn't a better model. It's the layer built around it: the model provides the reasoning. The harness controls the context, tools, permissions and checks around that reasoning. Together, they give an AI agent the structure it needs to operate reliably in real legal workflows. That discipline is harness engineering and it's the layer legal AI has skipped for too long.
A legal AI model can reason about a contract clause or a discovery request. It cannot, on its own, know which case management system to pull from, whether it's authorized to file a document or when to stop and wait for an attorney's sign-off. That surrounding structure, the one that decides what the model can see, which tools it can touch and what gets verified before anything goes out under a firm's name, is the harness. Harness engineering is the discipline of building that structure deliberately rather than assuming a capable model will handle it on its own.
The formula is simple: Agent = Model + Harness. The model supplies reasoning. The AI agent harness supplies everything that turns that reasoning into an action a firm can stand behind permissioned access to legal databases, citation checks, matter-specific memory and a gate for human review before anything reaches a client or a court. Strip the harness away and you're left with a model that sounds confident and a firm that has no way of knowing whether it should be trusted.
Legal work carries a lower tolerance for error than almost any other AI use case and the data backs that up. A Stanford RegLab and Stanford HAI study found that even premium, retrieval-grounded legal research tools marketed as "hallucination-free" produced incorrect or misgrounded answers on 17% to 33% of queries while general-purpose models tested on the same legal questions hallucinated at rates as high as 58% to 82%. That's not a rounding error. That's a legal AI hallucination rate that turns into sanctions, malpractice exposure and reputational damage the moment it reaches a filing.
Confidence hasn't caught up to that risk. Only 32.1% of legal AI users report high trust in the output they receive, a gap that shows lawyers already sense what the research confirms: model quality alone doesn't equal courtroom-ready output. And the consequences are no longer theoretical. Documented court cases involving AI-generated hallucinations have grown sharply from roughly 10 in 2023 to over 1,700 globally by mid-2026 with quarterly sanctions now exceeding $145,000 in a single quarter. Legal AI reliability isn't a nice-to-have feature set. It's the baseline requirement before an agent can be trusted with a matter, a filing, or a client relationship.
Picture a mid-size firm using AI to review an incoming NDA. The associate refines the prompt, adds prior firm templates and gets a polished draft. But the model still changes a jurisdiction-specific clause without flagging it for review. That’s not a prompt or context problem. It’s a missing harness.
Here’s where each discipline fits in that workflow:
Scroll horizontally to view all columns.
| Stage of the NDA review | What the team adjusted | What still went wrong |
| Prompt engineering | Rewrote instructions so the model flags "unusual" clauses | The model still can't tell an unusual clause from a jurisdictionally invalid one, wording alone doesn't add legal judgment |
| Context engineering | Fed in past NDAs, firm precedent and client-specific templates | The model now writes in-style but nothing stops it from quietly altering a clause outside its authority or missing that it needs a partner's sign-off |
| Harness engineering | Verification checks the clause against jurisdictional rules, tool permissions restrict what the model can edit and an approval gate routes the draft to an attorney before it leaves the system | This is the layer that actually catches the problem because it governs the system the model operates in, not just what it's told or shown |
The first two disciplines make the model sound better. Only harness engineering governs whether the output can be trusted enough to act on which tools it touches, what gets verified and who signs off before anything reaches a client. For legal work specifically, that's not an optimization. It's the control layer that decides whether an AI agent harness belongs anywhere near a live matter.
A model can draft a memo. Whether that memo is trustworthy depends on the system built around it. That system breaks into five layers, each solving a failure mode specific to legal work and worth building in roughly this order.
Build this first, it's most directly tied to sanctions exposure. AI agent verification checks every citation against a live legal database before it's accepted. AI agent guardrails define what the system never does unreviewed and human-in-the-loop AI is the attorney sign-off before anything leaves the system.
Next: contain the damage of anything that slips past verification. AI agent permissions mean scoped, least-privilege access to research databases and case systems, strictly confined to one matter so nothing leaks across client files. AI agent security here is a lawyer's duty of confidentiality, extended into the tool layer.
Context engineering for legal AI means feeding the model matter-specific facts, ranked by source hierarchy. Just as important is what's left out, dumping an entire case file only buries the controlling clause. Good legal knowledge management retrieves only what the task needs.
Legal matters run for days, not minutes. AI agent orchestration keeps a multi-stage review on track and AI agent memory retains matter facts across sessions instead of restarting. Add this once verification and permissions are solid.
"The model decided" isn't an acceptable answer to a partner or a bar complaint. AI agent observability logs every tool call and source consulted and AI agent evaluation tests whether guardrails still hold, model upgrades are only worth pursuing once this is in place.
The instinct when a legal AI tool underperforms is to upgrade the model. The evidence says that's usually the wrong fix. Cursor's own agent benchmarking found the same model scoring 46% on one harness and 80% on another, identical weights, identical task, a 34-point swing driven entirely by the scaffolding around it. A separate benchmark audit found the same pattern elsewhere: Claude Opus scored 93% on Terminal-Bench 2.0 running inside Cursor's harness, versus 77% running inside Claude Code's own harness, a 16-point swing from harness choice alone, with no model change involved.
This is the uncomfortable truth for firms evaluating legal AI models: the model you choose is often not the variable that determines whether an agent is trustworthy. The harness is. A newer, more expensive model wrapped in a thin, unverified system will still hallucinate citations and miss jurisdictional nuance because nothing in that system was built to catch it. Harness engineering is what closes that gap and it does so regardless of which model sits underneath, which is exactly why chasing the next model release is rarely the fix a firm actually needs.
The consequences of skipping harness engineering are documented in court orders, with penalties escalating from $5,000 (2023) to six figures plus suspensions (2026), with courts uniformly rejecting "technological ignorance" as a defense. Each major case maps to a specific missing harness layer:
Scroll horizontally to view all columns.
| Case | Court & Date | Sanction | Missing Harness Layer | What Failed |
| Mata v. Avianca | S.D.N.Y., June 2023 | $5,000 fine + mandatory mailing of sanction order to every cited judge | Validation & Repair Layer | Six fabricated case citations generated by ChatGPT; attorneys relied on chatbot's false assurance that cases were real without independent verification |
| Wadsworth v. Walmart | D. Wyoming, Feb 2025 | $5,000 fines across 3 lawyers + pro hac vice revoked | Gated Execution Layer | AI-generated citations filed without human review gate; no policy engine requiring attorney sign-off before submission |
| Couvrette v. Wisnovsky | D. Oregon, Dec 2025 | ~$109,700 combined (record penalty at the time) | Context Orchestration + Validation Layers | Citations not cross-referenced against authoritative databases; no schema validation requiring source field populated from approved repositories |
| Whiting v. City of Athens | 6th Circuit, 2026 | $15,000 per attorney + fees + double costs (~$71K each, $116K total) | Validation + Gated Execution Layers | Hallucinated cases in appellate briefs; no repair loop to self-correct, no escalation to supervising counsel when confidence low. |
Every failure we've walked through from six-figure sanctions to fabricated citations reaching federal courts traces back to the same root cause: a capable model operating without a harness built to catch it. Harness engineering decides whether an AI agent harness can be trusted with a real matter and it's exactly why off-the-shelf tools keep hitting the same wall they're built for the average firm, not yours.
Custom-built software closes that gap, shaping verification, permissions and approval workflows around how your firm actually practices law. The model will keep getting better; the harder question every firm still has to answer is simpler when your legal AI agents act on a live matter, what's actually standing between that action and a mistake and would it hold up if a judge asked? If your firm is ready to find out, OWNEDLEGAL AI builds legal AI harnesses designed around how you actually practice, get in touch to start the conversation.
Harness engineering designs the environment around an AI model so an AI agent can work reliably. It covers tools, context, permissions, guardrails, verification and human oversight.
An AI agent harness connects an AI model to the tools, data, rules and controls it needs to complete tasks. For legal AI, it can control data access, tool use, approvals and output verification.
An AI model generates and reasons from information. An AI agent uses that model to pursue a goal through multiple steps, such as retrieving documents, analyzing them and producing a report.
Legal AI agents need a harness to enforce confidentiality, permissions, source verification, auditability and human oversight when performing real legal work.
It cannot eliminate hallucinations but it can reduce their risk and impact through source verification, access controls, output checks and human review.
Tell me about the system or workflow you are working on.
30-minute intro call on Calendly
| Tan Hai Peng v. Tan Cheong Joo | High Court Singapore, 2026 | Personal costs against junior AND supervising partner | Supervision & Accountability Layer | First ruling explicitly tying supervisory liability to AI errors, partners held responsible for failing to implement oversight mechanisms |
| Withers v. City of Aberdeen | N.D. Mississippi, June 2026 | Trial canceled; 2-year suspensions; fines both sides | Full Harness Absence | Complete breakdown: no validation, no gates, no audit trail, no recovery resulted in case-dispositive prejudice |
| 9th Circuit (Sethi & Rounds) | 9th Circuit, June 2026 | $2,500 per attorney + 6-month suspension + 2-year AI disclosure requirement | Normalization + Validation Layers | Nonexistent cases filed; attorneys claimed typographical errors; court rejected and imposed ongoing disclosure obligations |
| 5th Circuit (Hersh) | 5th Circuit, Feb 2026 | $2,500 sanction | Validation Layer | Brief drafted largely by AI; attorney failed to verify accuracy before filing |
