Projects, per-user connectors, tool approval, a connector in your own cloud. What each isolates for a four-attorney firm on Enterprise, and what does not.
[ KEY TAKEAWAYS ]
Matters stay apart in Claude Enterprise through four mechanisms, and none of them is automatic. A Project per matter keeps knowledge and instructions inside that matter's chats. Per-user connector authentication means Claude only reaches what the signed-in lawyer can already reach in MyCase, SharePoint or Outlook. Org-wide tool policies let the owner set every connector action to always allow, needs approval, or blocked. And a connector that runs in the firm's own cloud writes an audit record per action, attributed to the user. What does not isolate anything: a long chat reused across matters, a Project shared with the whole firm, a connector signed in with one shared account, and the assumption that "Enterprise" means zero retention on chat. It does not.
Project per matter: the practical unit of isolation on Team and Enterprise.
tool policy states an owner can set org-wide: always allow, needs approval, blocked.
pilot seats the firm started with, on Enterprise, with Microsoft 365 already connected.
zero-data-retention options on Enterprise chat. Unattended jobs belong on the API.
The partner's first question on the call wasn't about features. His firm had Microsoft 365 connected to Claude already, wanted MyCase, LexisNexis and Adobe connected next, and he wanted "a safe environment" first: "I don't want these folders to communicate with one another, so I don't want facts to bleed across from one issue to another." The scope his IT administrator sent the next day said the same thing in contract language: per-user authentication honouring each system's permissions, no shared identities, audit records attributing every action to the initiating user. That is the right question, and this is the mechanics of the answer.
"If Claude can see our documents, our case system and our email, what stops one client's facts from ending up in another client's memo?" The first thing the partner asked, before price, before features.
| Mechanism | What it isolates | Who sets it | Where it stops |
|---|---|---|---|
| A Project per matter | Knowledge files and standing instructions are visible only inside chats opened in that Project. Chats outside it do not see them. | Any member creates; Owner decides sharing rules; share with the people on the matter, not the organization | A user who opens a general chat and pastes the matter in has left the Project. Training fixes that, settings do not. |
| Per-user connector authentication | Every member enables a connector for their own account and signs in as themselves. MyCase, SharePoint and Outlook then apply their own permissions to that user. | Owner adds the connector org-wide; each member authenticates | Only as good as the permissions in the source system. A paralegal who can open every matter in MyCase can open every matter through Claude. |
| Tool policy: allow, approve, block | Each tool a connector exposes (create a task, send an email, save a file) is set org-wide. "Needs approval" puts a person between Claude and the write. | Owner or Primary Owner; members cannot override | Policies are per tool, not per matter. Matter-level write rules live in the connector or the source system. |
| A connector in the firm's own cloud | The service authenticates each user, passes that identity to the practice system, and writes an audit record per action with the user's name. Repos, logs and data stay in the firm's accounts. | The firm's IT administrator holds credentials and deployment approval | Must be reachable from Anthropic's network over streamable HTTP with OAuth and PKCE; a laptop-only install does not serve scheduled jobs. |
Mechanics per Anthropic's support articles on custom connectors and Enterprise administration, read 7 October 2026.
One Project per open matter, named the way the file is named in MyCase, shared with the attorney and the paralegal on it and nobody else. One Project for firm standards (letter, memo, brief, motion and intake-form instructions) shared with everyone, holding no client facts. Connectors added by the organization owner, with every write tool on "needs approval" for the first month. The four pilot users trained to open the matter's Project before they open a chat about it. That last line is the one that fails first, which is why training belongs in the scope as a deliverable.
Retention
"Enterprise" is not zero retention
Enterprise does not train on your data and gives you audit logs and a Compliance API. Chat still has a retention floor and no zero-data-retention option. The API has one. Anything that runs without a person, a morning summary or a Monday report, belongs on the API from your own cloud, and your scope should say so.
Identity
One shared login for a connector
A connector signed in with "office@" sees everything office@ sees, for everyone, and the audit log says office@ did it. The firm's scope banned shared identities in one sentence. Copy the sentence.
Habit
The long chat that never ends
Most real leaks are a lawyer with one chat open all week, pasting three matters into it. Projects fix this only if people use them, which is a training problem with acceptance criteria, not a settings problem.
Three habits that undo all four settings One long chat reused across matters. A Project shared with everyone. A connector signed in with a shared account. Each one is cheaper and faster on the day, and each one puts the Jones file in the Smith chat.
The firm's scope ordered the build: shared security foundation first, Microsoft 365 alongside, then MyCase and Lexis, then Adobe. The foundation is the connector service itself, hosted in the firm's Azure tenant, with the IT administrator holding credentials and deployment approval. Here is what it has to do, as a decision list.
A lawyer asks Claude for a matter's documents
The connector takes the lawyer's own sign-in, asks MyCase as that lawyer, and returns only what MyCase would show them. The audit row says who, what, when.
Claude is about to create a task or a note
The tool is on "needs approval" org-wide, so the lawyer confirms. The scope limited phase-one writes to tasks and notes; case creation and edits to case records are out until the audit trail has earned trust.
A Monday report has to run before the 9 a.m. meeting
A job on the firm's Azure service calls the API under the firm's own key, with zero data retention, and posts the result to Teams or Outlook. No chat, no person, no retention floor.
The firm changes vendors
Repositories, the Azure resources, the database and the audit log are already in the firm's name. Documentation lets another developer take it over, including from us.
Clio's Vincent, Thomson Reuters' CoCounsel and HighQ, Harvey and Docket Navigator all publish Enterprise connector instructions now, and every one of them follows the same owner-adds, member-authenticates model. The mechanics are not exotic. What is rare is a scope that asks for them before the first feature.
Writing the "safe environment" section of your own scope?
Thirty minutes with a co-founder: we read your Claude plan, your practice system and your cloud account together and turn the partner's question into the four settings and one connector that answer it.
The second thing the partner asked for was a system of "here is how our firm operates", in his words "from a letter to a memo to a brief to a motion to simple intake forms". On Enterprise this is a shared Project with the firm's templates and instructions and no client facts, plus skills for each document type. It isolates nothing by itself. It does the opposite job: it makes the matter Projects consistent, so a paralegal in matter A and an associate in matter B produce the same letter in the same voice, each from their own Project.
Section 3 of the document, paraphrased but complete: provide a private hosting and authentication foundation reusable by all custom connectors; authenticate each user individually and honour the permissions that user already holds in each connected system; avoid shared user identities for access to firm data; maintain audit records that attribute connector actions to the initiating user; document credential handling, permission scopes, access controls and administrative procedures; define safeguards for confidential client information and human review of outputs and consequential actions; document the controls the firm can assess against its professional obligations, and do not represent the implementation alone as a guarantee of legal compliance.
That last clause is the mark of a firm that has read its bar's cloud opinions. It is also the clause we would put in every scope, because it is the honest one. Settings and connectors give a partner the controls. The partner assesses them. Nobody sells compliance in a box, and the firms that know that write better scopes. We took that scope apart section by section, with a template, in what a law firm's AI integration scope of work looks like.
Inside a single chat, Claude only sees what is in that chat, its Project, and whatever a connector returns for the signed-in user. A Project's knowledge and instructions are visible only in chats opened inside that Project. The realistic leak paths are human ones: a user who keeps one long chat for every matter, a shared Project with the wrong members, or a connector that signs in with a shared account. Each has a setting that closes it.
A Project is a separate workspace with its own document library and standing instructions; every chat opened inside it sees the same files and rules, and chats outside it do not. On Team and Enterprise a Project can be shared with specific members or the whole organization. One Project per matter, shared with the people on that matter, is the practical unit of isolation.
Only an organization Owner or Primary Owner. Members then enable and authenticate the connector for their own account, so a connector only ever acts with that user's own permissions in the underlying system. Owners can also set each tool the connector exposes to always allow, needs approval, or blocked, org-wide.
Not on chat. Enterprise does not train on your data and keeps a retention floor on conversations; zero data retention is available on the API. That is why scheduled jobs that run without a person belong on the API from the firm's own cloud, and why a firm should say so in its scope.
Three things. Authenticate each user individually (OAuth with PKCE over streamable HTTP is what Claude requires of a remote connector). Pass that user's identity to the practice system, so its permissions apply. Write an audit record per action attributed to the user. The scope a four-attorney firm sent us demanded exactly this, with no shared identities for firm data.
If the firm wants an organization owner who controls connectors and tool policies, SSO, audit logs, and an official practice-management connector that only installs on Team or Enterprise, then yes, and the seat minimum is the thing to check with Anthropic sales. If the firm only wants one lawyer to try Claude, it is not. The four-attorney firm in this post chose Enterprise and started with four pilot seats.
NEWSLETTER
[ WRITTEN BY ]
Petar Jovanović
Co-Founder & Technical Lead
Co-Founder and Technical Lead at Oktopeak. Builds regulated software for legal and healthcare teams, and leads the rescues of codebases other vendors left half-finished.
[ LEGAL TECH ]
LEGAL TECH
Oct 7, 2026 · 9 min read
The anonymised 13-section scope a four-attorney firm sent us for Claude, Microsoft 365, MyCase and Lexis: what it got right, what it missed, plus a template.
Read ArticleLEGAL TECH
Jun 29, 2026
Lawyers test Claude on Pro, run out after a couple of documents, and jump to Max without knowing what they actually need. Here is how to choose between Pro, Max, the API, and Enterprise for a law firm, by usage limits, cost, and what each one does with your client data.
Read ArticleLEGAL TECH
Jun 3, 2026 · 11 min read
ZDR is not available on Claude Team or Pro chat. It is available on the Anthropic API at the organization level, which a small firm can obtain. Here is the real difference between the chat tiers and the API, why a Canadian or healthcare firm hits a residency wall, and the architecture we use to keep privileged data off retention.
Read Article[ GET STARTED ]
30-minute call. No pitch deck. Just an honest conversation about your project.
