Handing a matter to your own drafting software

A copy of a client’s instructions leaving Orchard72 is the one step in the professional workflow that cannot be undone, so four things have to be true before the request is even offered to the client. The egress pane on the matter tells you which one is missing.

• Your professional profile is verified. An unverified profile cannot be engaged, so it never reaches this point.
• The client has signed your engagement letter for this matter. Instructions do not travel before signature.
• Your firm has accepted the data-sharing addendum. It is signed once for the firm, not per matter, and it is what records that your firm becomes a controller of any copy it takes.
• You are engaged at full or review access on the matter. A client who has chosen you but not yet engaged you is not covered.

You ask from the "Use your own drafting software" pane on the matter. The pane itemises, section by section, exactly what would be sent before you ask, so you can tell the client accurately what you are asking for.

1. Open the matter and select Request consent on the egress pane.
2. The client is notified and sees the same section-by-section list you saw, in their own privacy centre.
3. The client picks how long the permission lasts from the periods the consent form offers.
4. The client ticks an acknowledgement that a copy already taken cannot be recalled. Nothing is prepared until they do.
5. The pane opens, and you can collect the pack by file or by API for as long as the permission runs.

The permission ends by itself at the end of the period the client chose. The client can also withdraw it at any point from their privacy centre without telling you first, and every copy you take is listed for them there with the date, the lane and the sections it carried.

The pack carries the client’s instructions, not a drafted will, and it carries only the sections your current access already opens. Each section arrives with a line describing what it is, so a pack read out of context is still self-describing.

There are two lanes and they carry the same content. Which one suits you depends on whether your drafting software can call an API.

# 1. Mint a key with the pro:read scope in your developer hub, then
#    put it in a file curl reads, NOT on the command line. Every process's argv
#    is readable by other users on the same host, so a key passed with -H leaks
#    to anyone who can run ps.
umask 077; TW_CFG=$(mktemp); trap 'rm -f "$TW_CFG"' EXIT INT TERM HUP
printf 'header = "Authorization: Bearer %s"\n' "$TW_KEY" > "$TW_CFG"

# 2. List the matters you may pull a brief for (no client data in this response)
curl -s --config "$TW_CFG" \
     https://api.thewill.ai/api/v1/pro/ext/matters/

# 3. Fetch one brief. Use an id whose brief_available was true.
curl -s --config "$TW_CFG" \
     https://api.thewill.ai/api/v1/pro/ext/matters/MATTER_ID/brief/

# 4. A lapsed or revoked grant answers 404, not 403. Handle it as "not available
#    now" and re-read brief_available, rather than treating it as a hard error.
curl -s -o /dev/null -w '%{http_code}\n' --config "$TW_CFG" \
     https://api.thewill.ai/api/v1/pro/ext/matters/MATTER_ID/brief/

Nothing about this step is ours. You draft in the software your firm already uses, against the instructions in the pack, applying your own house style, your own precedent bank and your own checking.

Two practical points are worth building into your process. Pin the schema version your integration reads, so a later addition to the brief cannot silently change what your software maps. And keep the manifest with the matter file: it is the record of what you were sent, and it is the thing that answers a later question about scope without anyone having to reconstruct it.

All three routes are first class. None of them is a fallback, and all three land in the same place, so the client’s record, the audit trail and the storage are identical whichever you use.

1. Upload the finished document. A PDF or Word file of the executed or engrossed will, read by the platform extraction step.
2. Upload structured data. JSON on the same published schema you were sent, or CSV on the importer vocabulary, if your software can emit it.
3. Draft here instead. If you used our wizard for this matter, nothing extra is needed and the return is already recorded.

Where the pack you were sent carried will instructions, the return is compared against it field by field, and you are shown every field that changed, was dropped or was added before the matter completes. That check exists because we know exactly what we sent you, so the comparison is against a known reference rather than a guess. You confirm the differences, and re-editing after you confirm asks you again.

Consent can end mid-matter in three ways: the period the client chose runs out, the client withdraws it, or the engagement itself ends. What happens next is the same in all three cases.

• The API stops returning the brief on the next call, with the uniform 404 described below. There is no grace period.
• Any signed download link stops working, and no new pack can be minted.
• A copy you already downloaded is still on your disk. We cannot recall it, and we do not pretend to.
• You can still return the finished will. A return is you giving us data, not us giving you more, so it is accepted whether or not the consent is still live.

If you still need the instructions, ask again from the pane rather than working from a stale pack. A fresh consent is a fresh decision for the client to make, and a fresh pack reflects any changes they have made since.

These are stated here rather than left in the addendum, because they are the part of this workflow that a fee earner meets in practice. They are a description of the position, not advice on it. Your firm’s own compliance adviser is the right person to tell you what your obligations require of you.

• Your firm becomes a controller of the copy it takes. From the moment the pack lands on your systems, your firm decides what happens to it, and your own retention, security and subject-access processes apply to it.
• The pack names people who never dealt with us. Executors, beneficiaries and guardians are in it because the client named them. Article 14 of the UK GDPR places an information duty on a controller who obtains personal data from someone other than the person it is about, and that duty may fall on your firm in respect of those people. What it requires of your firm in practice is a question for your own compliance adviser.
• We cannot recall the copy and we do not police it. Once a pack has been downloaded, revoking the client’s consent closes our lanes; it does not reach into your systems. There is no automated control on our side that can undo a download, and we would rather say so plainly than imply otherwise.
• The client can see every copy you took. Each one is listed in their privacy centre with the date, the lane and the sections it carried, so a question about scope has a shared answer.

• Matter-brief API, the endpoint and schema reference to hand to your developer.
• Engagement letters, which decide whether a matter can be exported at all.
• CMA compliance, for the transparency expectations that sit alongside this workflow.