Which Claude Surface Fits Your Law Firm Workflow?

A user may experience Claude through conversational chat, Projects, Cowork, Microsoft 365 connectors or Office experiences, Claude Code, an application built on the API, or an agent assembled and operated for a defined workflow. These surfaces may use related models while differing materially in identity, administration, information access, retention, audit, integrations, action authority, and support.

A policy that simply approves or prohibits “Claude” is therefore too coarse. The firm should record the exact organization, plan, surface, user population, task, information classification, connected systems, tools, contract, and owner. Product availability and terms change, so the inventory should include a verification date and a trigger for review.

Chat or Projects may support individual analysis and organized context. Cowork can support longer-running, tool-using work. Microsoft 365 paths may retrieve organizational email, files, conversations, or other content under configured permissions, and optional tools may act on a user’s behalf. API-based applications create a separately designed architecture with their own hosting, identity, prompts, storage, logs, integrations, and operational owner.

Do not infer that a control documented for one surface applies to another. A commercial no-training commitment is not a retention schedule. A configurable chat-retention policy does not automatically describe an Office add-in, connector, file service, API integration, or third-party legal platform. Map every processor and data path that participates in the intended workflow.

Identify who owns the tenant or organization, seats, API account, consumption, vendor relationship, connector consent, third-party licenses, incident contact, and renewal. A paid end-user subscription may not include API usage, implementation, legal research content, or partner systems. Avoid comparing a seat subtotal with a fully integrated workflow as though they purchase the same outcome.

For custom or managed applications, decide who maintains instructions, tests model changes, handles failures, rotates credentials, monitors cost, updates integrations, responds to security events, and supports users. The flexibility of an API or agent architecture creates value only when the firm also accepts or assigns the responsibilities that packaged products would otherwise carry.

Start with the least complex surface that can answer the business question. Use non-client material, restrict access and actions, test ordinary and adverse cases, and measure verified effort. Record the approved users, information, sources, tools, reviewer, retention, evidence, and stop conditions for that specific path.

Expansion to another surface is a new decision because it may introduce different permissions, data handling, administration, or support. A successful chat pilot does not authorize a Microsoft 365 connector, and a useful document review does not authorize scheduled tasks or external writes. Surface-specific approval keeps experimentation compatible with accountable governance.