LawVu now lets outside tools create matters and trigger contract workflows. Legora's DiliTrust link only reads. Here is what that split means for legal ops.
Two announcements on November 11 show how differently in-house legal platforms are deciding what outside tools may do with their records. LawVu said its customers can now connect Claude, Microsoft Copilot, ChatGPT, Harvey and Legora to its LegalOS, and those connections can change records, not just look them up. The same day, Legora and DiliTrust announced a link that reads DiliTrust contract and entity data without altering it. For legal ops leads deciding which connections to switch on, the difference between reading and writing is the governance question that matters most.
What LawVu Turned On
According to [LawVu’s release on PR Newswire]( https://www.prnewswire.com/news-releases/lawvu-connects-anthropics-claude-microsoft-copilot-openais-chatgpt-harvey-and-legora-to-in-house-legals-data-and-workflows-302935762.html), the five connections run through the LawVu MCP Server, built on the open Model Context Protocol standard, and are available now with no custom development. LawVu says the server “exposes more than 50 actions for reading and updating LawVu data.” Its own example: a lawyer working in Copilot asks which vendor contracts auto-renew next quarter, gets an answer from the team’s LawVu contract repository and assigns a review task to a colleague without leaving Copilot.
The [LawVu Help Center page for the MCP server]( https://help.lawvu.com/en/articles/15266786-lawvu-mcp-server) spells out the scope. Read access covers matters, contracts, knowledge articles and document search. Write access lets a connected tool create new matters and wizard-based contracts, post status updates on matters or contracts, create and assign tasks, trigger contract workflows and create field options for supported field types. No delete action appears on the write list. LawVu says the scope “will expand over time based on feedback and usage by early adopters.”
The feature is opt-in. A customer has to ask its customer success manager or LawVu support to activate it, and then an organization admin enables it from the Integrations screen.
What the Legora and DiliTrust Link Does
[Legora’s announcement]( https://legora.com/newsroom/legora-and-dilitrust-partner-to-connect-legal-ai-with-contract-and-entity-management-for-in-house-legal-teams) describes a narrower design. Mutual customers will be able to search DiliTrust contracts, approved templates and entity records from inside Legora and use them as context for research, review and drafting in Legora. Legora states that the integration “reads DiliTrust data without altering it” and that “any change, approval, or signature still happens in DiliTrust, where the record is kept current.” Access follows the permissions set in DiliTrust.
Two caveats matter. The link has been announced, not broadly launched: it “will be made available to mutual customers through an early access beta,” with no general availability date given. And the companies call it “the first step in the partnership,” with more features planned in later phases, so read-only is the starting design rather than a stated permanent policy.
“Those teams shouldn’t have to switch systems to find the position taken
in a prior contract or check how a subsidiary is owned,” said Gabriel Quek,
Senior Director of Technology Partnerships at Legora.
The Governance Fine Print
LawVu’s documentation is unusually direct about risk. It says each person’s LawVu permissions carry into every connected tool and that the server “does not grant any elevated permissions,” so a tool cannot reach a matter or contract its user could not open in LawVu. Every action taken through the server lands in LawVu’s activity log, the same as actions taken inside the product.
The same page is just as clear about where LawVu’s control ends. Data a connected tool pulls is sent to and processed by that tool’s provider, and the Help Center says LawVu “does not control how third-party” providers handle data passed to them this way. It tells customers to review each provider’s data processing terms against their own obligations, naming GDPR and HIPAA. It also recommends requiring human review and approval before any tool-initiated action that creates, modifies or deletes records, granting the minimum access needed, starting with a defined group of early adopters and checking the audit log regularly. It flags prompt injection and look-alike third-party servers as risks too.
That is a vendor saying, in its own words, that writing back is powerful and that the customer owns how it gets used. DiliTrust and Legora have, for now, avoided that question by keeping every change inside DiliTrust.
For legal ops, the practical work is the same either way. Decide which connected tools are approved under your acceptable use policy and confirm each provider’s data terms before anyone authorizes a connection. For write access, decide which actions need a person to confirm them and who reviews the activity log, and how often. Pricing for both integrations has not been disclosed, and neither company has said how many customers have the connections enabled.
Common Questions
Can a connected tool see records a user cannot?
No. Both LawVu and Legora say access follows the permissions already set in the underlying system.
Can tools delete LawVu records?
Delete is not listed among LawVu’s current write actions. LawVu’s advice on human approval covers any action that creates, modifies or deletes records.
Is the DiliTrust link available today?
Not generally. It is planned for mutual customers through an early access beta.
What to Watch
Partly Real. LawVu’s write access is live and well documented, including its own warnings about where its control stops. The DiliTrust link is still a beta announcement, so watch whether it stays read-only once later phases ship and whether customers actually leave LawVu’s write actions on after their first review.
*QUINN ASHBY*Staff Writer, Legal Tech Circle
e. quinn@lionfiregroup.co w. www.lionfiregroup.co
