This is the third episode of Agent Eye-Openers, a series of conversations that delves into the decisions, discoveries, and wake-up calls defining the AI era.
In the legal industry, the stakes are as high as they get. "Lives are at stake in our industry," explains Nate Astle, VP of Engineering at Filevine. "If you miss a filing, a deadline, or critical information, your client could end up in jail."
Filevine is a complete legal operating system that manages highly confidential data—from HIPAA-regulated medical records to sensitive litigation strategies. When the company began building its AI agent, LOIS, to help lawyers analyze cases, draft documents, and query data lakes, Astle faced a critical reality: The margin for permission error was zero.
This is why Astle and his team prioritized getting permissions right from the outset. Partnering with Okta, Astle’s team created an expansive index for managing both people and agents. Rushing to launch an AI interface without these robust controls would have been a massive gamble. "It’s like building a house without load-bearing walls," Astle says. "The structure might stand for a short time, but eventually, it will collapse."
A foundation for autonomous workloads
Traditional software operates in predictable, deterministic lanes. You know exactly what data a user needs to access and when. But generative AI fundamentally breaks these legacy models. AI agents operate by traversing, reasoning over, and sifting through petabytes of decentralized data in seconds.
Early in its platform modernization journey, Filevine realized that legacy, project-level permissions could not support autonomous AI workloads. The team faced a classic build-versus-buy decision. They evaluated building a system from scratch or leveraging OpenFGA. However, establishing and propagating real-time permissions across distributed data stores would require a massive engineering effort.
To solve this, Filevine partnered with Okta to develop a custom implementation of Auth0 Fine-Grained Authorization. Together, the two teams built a centralized permissions index that propagates access changes across all systems, including data stores, in near real time. If, for instance, an attorney's role changes or they leave a firm, those permission updates sync across the entire ecosystem, preventing any unauthorized access. The same applies to AI agents.
Treating AI agents as first-class identities
While managing human permissions is already a complex requirement, Filevine quickly realized that it must bring the same rigor to AI workflows, particularly AI agents. The company used the blueprint for the secure agentic enterprise to guide its approach. Ultimately, Filevine aims to answer four key questions on behalf of its client law firms:
Where are my agents? Filevine treats AI agents as first-class identities, rather than generic accounts, keeping them strictly bound within designated workspaces.
What can they do? Using Auth0 FGA, Filevine restricts LOIS and its sub-agents to the precise permission scope of the active attorney. Agents cannot bypass these boundaries to access unauthorized records.
What are they doing? Filevine couples Okta’s identity layer with robust, built-in audit logging. This allows compliance-minded clients to verify exactly which files an agent accessed and when.
How do I respond? If an agent begins to consume excessive resources or runs unexpectedly, Filevine can deploy kill switches to stop the autonomous workflow.
Solving the auth challenge up front to unlock faster AI innovation
By setting up fine-grained authorization early, Filevine avoided the painful process of retrofitting security protocols into an existing product. Instead, the company created a multi-year competitive moat.
"We solved these security and data access problems upfront," Astle says. "As a result, we were able to see our AI engineering efforts move at four times the speed." Because the team did not have to spend cycles chasing down permission issues or managing technical debt, they could focus entirely on building high-value, secure AI features.
For other technology leaders preparing to put autonomous agents into production, Astle has one non-negotiable piece of advice:
"Get permissions in place at the start of your project," Astle says. "This defines your data access patterns and allows you to move faster in the future. The speed you will gain is invaluable."
Watch the full video above to hear more of Nate's insights on managing AI agents and their access.
