A Handoff Is a Surface
Why internal integration does not save the analytical perimeter.
Abstract
A companion essay argued that trustworthy evidence intelligence requires a bounded analytical perimeter — that the analytical layer of an AI system must not be able to cause effects outside itself through uncontrolled handoffs, integrations, or tool surfaces. A predictable response from integrated legal-AI products is that their evidence-analysis features and drafting features live inside the same product, often inside the same codebase and vendor stack. No network boundary is crossed. No third-party tool is invoked. The bounded-perimeter critique, they conclude, does not apply.
This paper rejects that defense. The boundary that matters is not corporate. It is functional. A handoff from evidence analysis into drafting is already a surface in the relevant architectural sense, even if it never leaves the vendor’s infrastructure. The question is not who owns the next layer. The question is whether the analytical layer can reach the next layer at all. Once it can, the bounded property has been abandoned at the seam between functions, not at the seam between vendors.
1. The objection
A legal-AI product responding to the bounded-perimeter argument has a ready defense.
Our evidence-analysis features and drafting features are part of the same product. The data never leaves our infrastructure. The integration between analysis and drafting is internal, designed by us, running on our servers, written in our code. There is no outbound exposure in the network sense. The bounded-perimeter critique applies to systems that reach out to third-party services. It does not apply to integrated workflows within a single vendor’s stack.
This defense will be offered by products that are otherwise sophisticated, well engineered, and run by serious people. It will sound reasonable to buyers who are accustomed to thinking about software security in terms of network perimeters and vendor trust.
The defense is wrong.
The reason it is wrong is that the relevant boundary is not a corporate one. It is a functional one.
This paper makes that distinction explicit.
2. The functional boundary
The boundary that matters is not corporate. It is functional.
The bounded-perimeter argument is not a claim about network topology, vendor relationships, or runtime ownership. It is a claim about what the analytical layer can cause to happen.
A surface, in the sense used here, is any architectural path by which the analytical layer can cause effects outside itself, or by which outputs that have passed through another layer can later condition further analytical operations.
The architectural commitment of a bounded evidentiary system is that the analytical layer produces its output and stops. The user may then read that output and decide what to do with it. The user may take it to a drafting tool, a research database, a partner, or nowhere at all. That decision is the user’s. The user is the bridge.
When the analytical layer instead hands its output directly to a drafting layer through an integration the product provides, the architecture has become the bridge. The product is no longer merely producing an analytical record for user review. It is coupling evidence analysis to advocacy-oriented generation inside the same system.
That is the boundary crossing.
The functional boundary lies at the seam between the analytical layer and any layer whose purpose is to produce content shaped by case theory, advocacy posture, or drafting objective. The corporate boundary lies at the edge of the vendor’s stack. These are not the same boundary. They can be very far apart.
A vendor whose product spans both evidence analysis and drafting contains the relevant seam in-house. The fact that the seam lives inside one company’s infrastructure does not make it disappear.
The question is not who owns the next tool.
The question is whether the analytical layer can reach the next tool at all.
3. What a handoff actually does
The argument becomes clearer when the mechanics of a handoff are stated plainly.
A drafting layer is, by definition, a layer that produces content shaped by case theory or advocacy objective. Draft a motion to compel. Draft a bad-faith complaint. Draft a settlement letter. Framing is not incidental to that layer. It is what makes the layer a drafting layer.
Once an analytical layer hands its output to a drafting layer, the bounded evidentiary property is already broken. The clean, source-tethered analytical record has entered a context whose entire purpose is framed content generation.
That alone is enough for the present argument.
Many integrated products then go further. The drafting output may influence later analytical operations, either explicitly or implicitly, because the product’s value proposition is the seamless movement of work across layers. When that happens, the problem compounds. Analysis is no longer operating on the evidence alone. It is operating on the evidence as mediated by advocacy-shaped output.
But the paper does not require the full loop to make its case.
The first handoff is already the relevant architectural event.
The companion paper named prompt stain as the loss of first-read provenance that occurs when framing reaches the analytical layer before independent reading. An internal handoff does not recreate the original first-contact event, but it reopens the same category problem at the seam: advocacy-shaped framing is now inside the product’s active analytical workflow. The evidentiary layer is no longer bounded in the sense the architecture requires.
4. The defenses, and why each one fails
A product responding to the argument above has several positions available. Each fails for a specific architectural reason.
The “it’s all our code” defense
We wrote both layers. We control the protocol. We guarantee the handoff is safe.
The bounded-perimeter property is about effects, not ownership. Whether the code on both sides of the seam was written by the same vendor is irrelevant to whether the seam exists. A same-vendor integration is still an integration across the functional boundary.
The “the data never leaves our infrastructure” defense
Nothing leaves our servers. No third-party service is invoked. The network perimeter is intact.
The functional boundary is not the network boundary. A local handoff between two layers on the same server crosses the analytical boundary just as completely as a remote handoff to a third-party service. The relevant property is not hosting location. It is whether the evidentiary layer can cause framed downstream operations.
The “we engineered the integration carefully” defense
We have safeguards, monitoring, context separation, prompt sanitization, and careful state management.
Careful integration of architecturally incompatible layers is still integration of architecturally incompatible layers. The existence of the handoff is the issue. Engineering the seam well is real work. It does not eliminate the seam.
The “our drafting layer is also bounded” defense
Our drafting layer is itself constrained, so the integration is safe.
A drafting layer exists to produce framed content. If it does not introduce theory-shaped or advocacy-shaped framing, it is not doing drafting in the relevant sense. If it does, then the analytical output has entered a framing-shaped operation. That is the boundary crossing the bounded architecture exists to refuse.
The “the user controls the handoff” defense
The integration is not automatic. The user chooses when to send analytical output to drafting.
This is the strongest defense and deserves precision.
If the user reads the analytical record, leaves the evidentiary system, and takes that material into a separate drafting process under their own control, the user remains the bridge and the analytical layer remains bounded.
If, by contrast, the user clicks a product-provided handoff that carries analytical output into a drafting layer inside the same product, then the product has created the bridge. Even if the user initiated it, the architecture now contains a live path from evidence analysis into advocacy generation.
That is the relevant difference.
A genuine user-controlled bridge is external to the evidentiary layer. An integrated product handoff is internal to the architecture.
The two are not the same.
5. What bounded analysis actually requires
The positive claim can be stated simply.
A bounded analytical architecture is one in which the analytical layer produces its output and stops. The analytical record is generated, stored, and made available to the user inside the perimeter. The user may review it, accept or reject particular conclusions, refine classifications, and record those judgments in the audit trail. These are downstream user acts against an analytical record that already exists.
When the analytical work is done, the user takes the analytical record out by deliberate action. The user may paste the chronology into a memo, use the contradiction map in a deposition outline, or build a pleading from the record in another tool. In that respect, the analytical record should function much like a careful litigator would use an associate’s memo: as input to advocacy work the lawyer performs themselves, with their own judgment, outside the analytical layer.
The architectural property that makes this possible is the absence of a live internal handoff from evidence analysis to drafting.
There is no button labeled draft from this analysis. There is no internal workflow that routes evidentiary output into an advocacy layer. The architecture does not connect the analyst’s work product to the advocate’s drafting system, because connecting them would collapse the distinction the architecture exists to preserve.
This is precisely the design choice integrated workflow products cannot make without changing categories. The handoff is not a convenience feature added at the edge. It is often the spine of the integrated value proposition. Removing it does not merely disable one feature. It changes what kind of product the system is.
6. What this means for the buyer
A firm evaluating legal-AI products is used to asking whether a product has evidence intelligence as a feature. After the arguments in the companion papers, the more revealing question is whether that evidence intelligence has a handoff to drafting or any other advocacy-shaped layer.
That question has a practical answer.
Ask the vendor whether the product offers a button, menu option, integration, or automated workflow that takes analytical output and uses it as input to drafting. If the answer is yes, the bounded analytical property described here is not being delivered, regardless of how the architecture is characterized.
If the answer is no, ask whether analytical output can later re-enter the product as context for further analysis after it has passed through drafting or other advocacy-shaped operations. If the answer is yes, the same problem exists in loop form.
This is not a matter of branding language. The handoff either exists or it does not.
A buyer who knows the question can determine the answer in a short technical conversation.
7. Closing
The objection this paper answers is the one integrated legal-AI products will predictably reach for once bounded-evidence architecture begins to circulate: we have evidence intelligence too, and because the integration is internal, the bounded-perimeter critique does not apply.
The answer is now clear.
The boundary that matters is not corporate. It is functional.
Internal integration is not containment. Same vendor is not the same boundary.
A handoff is a surface.
That is the distinction this paper formalizes.
This essay is part of The Foundation, a sequence on the architectural conditions for trustworthy evidence intelligence in legal AI.
More: [casegenie.ai/research]
David Garsia · Founder, CaseGenie.ai · david@casegenie.ai