Draft a Legal Document

Draft a Legal Document

One skill for every first-draft founder need. type param picks template + structure + citations. "Drafts only, never send / file / sign" discipline shared.

Parameter: type

Commercial paper (reads template library first):

• nda - bilateral or one-way NDA anchored on your template.
• consulting - consulting / contractor agreement anchored on CIIAA + deliverables + term.
• offer-letter - employee offer letter anchored on 409A + compensation + vesting + at-will language.
• msa - customer-facing master services agreement.
• order-form - order form tied to existing MSA.
• board-consent - written board consent (routine: officer appointment, option grant, 409A adoption, bank resolutions).

Privacy / policy:

• privacy-policy - full Privacy Policy with AI-training disclosure, SCCs, subprocessor list, legal-basis citations.
• tos - Terms of Service (usage, IP, acceptable use, liability cap, dispute forum).

Regulatory response:

• dsr-response - GDPR Art. 15 / CCPA DSR first-touch packet: acknowledgment + identity-verification request + export cover note (3 files).

Escalation:

• escalation-brief - structured brief for outside counsel: 2-3 sentence matter summary, specific questions for lawyer, quoted excerpts with cite, deadline, recommended firm type (corporate / commercial lit / privacy / IP / employment). Never names specific firms.

User names type in plain English ("draft NDA with Acme", "write our privacy policy", "package this for counsel") → infer. Ambiguous → ask ONE question naming 10 options grouped by bucket.

When to use

• Explicit: "draft {type}", "write our privacy policy", "respond to this DSR", "escalate this to counsel".
• Plain-English asks map to a type: "draft an NDA for {counterparty}" → nda; "draft a contractor / consulting agreement" → consulting; "draft a customer contract" / "MSA for {customer}" / "order form" → msa or order-form; "draft a board consent" / "board decision for {action}" → board-consent; "draft / update our privacy policy" → privacy-policy; "draft our terms of service" → tos; "a customer asked for their data" / "respond to a DSR / GDPR / CCPA request" → dsr-response; "package this for a lawyer" / "prep a handoff to outside counsel" / "trademark handoff to a lawyer" → escalation-brief.
• Implicit: chained from review-a-contract when output recommends counter-draft (type picked by contract type); from audit-compliance (scope=privacy-posture) when audit says policy stale; from plan-contract-pushback when redline needs specific clause text drafted.

Ledger fields I read

Reads config/context-ledger.json first.

• universal.legalContext + context/legal-context.md - required every type (entity, cap table, standing agreements, template stack, open risks, risk posture). Missing → run set-up-my-legal-info skill first (or ask ONE targeted question if skip ahead).
• universal.company - name, stage (language calibration all types).
• universal.entity - required for offer-letter (state of incorporation, issued shares), board-consent (authorized shares, directors, officers), escalation-brief (entity snapshot).
• domains.contracts.templateLibrary - pointing to template set → anchor draft there. Missing for commercial types → ask ONE question: paste template URL, connect Google Drive, or proceed from market-standard boilerplate with "no template found, using market-standard boilerplate" caveat stamped on draft.
• domains.compliance.landingPageUrl - required for privacy-policy and tos (Firecrawl scrape infer product surface, data collection, analytics).
• domains.compliance.dataGeography - required for privacy-policy and dsr-response (EU inclusion triggers SCCs + GDPR-Art-15 timing).
• subprocessor-inventory.json - required for privacy-policy (vendor list + DPA status).
• universal.posture.escalationThreshold - required for escalation-brief (frames "why we need counsel" framing).

Steps

1. Read ledger + legal context. Gather missing required fields per above. Write atomically.
2. Discover tools via Composio only when type needs one: googledocs / notion for mirror-copy (optional), googledrive for reading template library, firecrawl for landing-page scrape (privacy-policy, tos).
3. Branch on type.
   • nda / consulting / offer-letter / msa / order-form / board-consent: load matching template from library (or use market-standard boilerplate with caveat stamp). Collect variables (counterparty, dates, commercials, candidate name, grant size, vesting cliff - whichever apply). Substitute variables. Produce draft with top comment-block listing (a) variables substituted, (b) any variables needing founder confirmation. Comp structure (offer-letter) or share math (board-consent) non-standard → flag attorneyReviewRequired: true.
   • privacy-policy / tos: scrape landing page via Firecrawl, cross-reference subprocessor-inventory.json, identify data-collection surfaces (forms, analytics, cookies, payment), pick right sections (Collection / Use / Disclosure / Retention / Rights / Transfers / Security / Changes / Contact for privacy; Usage / Account / IP / Acceptable-Use / Payment / Termination / Warranty / Liability / Disputes for ToS). Cite GDPR articles for EU-inclusive geography, CCPA/CPRA for US. AI-training disclosure explicit (opt-in or opt-out, state it). Produce sectioned markdown draft.
   • dsr-response: compute statutory clock (GDPR Art. 15 → 30 days, CCPA → 45 days). Produce three files: acknowledgment.md (received, clock start, expected turnaround - no commitments beyond statutory timeline), identity-verification.md (what we need to confirm it's them), export-cover-note.md (template cover note; actual data export out of scope - founder runs export). Clock already < 7 days from statutory deadline → flag attorneyReviewRequired: true. Write as folder dsr-responses/{request-id}-{YYYY-MM-DD}/.
   • escalation-brief: structured brief in this order - (1) Matter in 2-3 sentences, (2) Specific questions for lawyer (numbered, scoped), (3) Deadline + why, (4) Quoted excerpts with cite (contract clause, email thread, statute), (5) Entity snapshot from universal.entity, (6) Recommended firm type (corporate / commercial lit / privacy / IP / employment - no firm names), (7) What we'd accept as outcome.
4. Write draft atomically (*.tmp → rename):
   • Commercial types → drafts/{type}/{counterparty-or-candidate}-{YYYY-MM-DD}.md.
   • privacy-policy → privacy-drafts/privacy-policy-{YYYY-MM-DD}.md.
   • tos → privacy-drafts/tos-{YYYY-MM-DD}.md.
   • dsr-response → dsr-responses/{request-id}-{YYYY-MM-DD}/ (folder with three files).
   • escalation-brief → escalations/{matter-slug}-{YYYY-MM-DD}.md.
5. Optional Google Docs mirror. googledocs connected → offer mirror draft (skill discovers slug at runtime, user confirms, mirror created with link back in artifact footer).
6. Append to outputs.json - read-merge-write atomically: { id, type: "draft" | "privacy-policy" | "tos-draft" | "dsr-response" | "escalation-brief", title, summary, path, status: "draft", domain: "contracts" (commercial) | "compliance" (privacy/dsr) | "entity" (board-consent) | "advisory" (escalation-brief), createdAt, updatedAt, attorneyReviewRequired? }.
7. Summarize to user. One short message in plain language: what you drafted, that it's a draft for review (not signed/sent), and whether a real lawyer should look at it. Never mention file names, paths, or the underlying procedure.

What I never do

• Send, file, post, or request signature on any draft. Founder delivers, publishes, or packages-for-counsel. Every artifact opens with one-line "DRAFT - NOT FOR SIGNATURE / NOT FOR PUBLISH" stamp.
• Invent clause, statute, or precedent I can't cite.
• Name specific law firms in escalation-brief. Firm type only.
• Make timeline commitments in dsr-response beyond statutory clock - dates cited are statutory, not promises.
• Hardcode tool names - Composio discovery at runtime only.
• Skip attorneyReviewRequired: true on comp-structure anomalies, share-math anomalies, or DPA gaps.

Outputs

• drafts/{type}/{slug}-{YYYY-MM-DD}.md (commercial types).
• privacy-drafts/privacy-policy-{YYYY-MM-DD}.md / tos-{YYYY-MM-DD}.md.
• dsr-responses/{request-id}-{YYYY-MM-DD}/ (3-file folder).
• escalations/{matter-slug}-{YYYY-MM-DD}.md.
• Appends to outputs.json.