Legal AI vendors increasingly compete on one promise: the assistant is grounded in your contracts and in the law. The harder question is what grounding means once it crosses an integration boundary, and whether permissions and citations survive the trip.

There is now enough published material to answer part of that question precisely, and to be explicit about the part that remains open.

Why this surfaced this week

OpenAI published a customer story on Legora on 28 October 2026, inside this edition's 36-hour window. It describes Legora using OpenAI models, ChatGPT and Codex to accelerate legal workflows and expand contract analysis. Only the publisher's summary was retrievable, so no performance figures from it appear here.

What that story reopens is a question with a better paper trail. In mid-October, Legora and Sirion published a detailed account of how a legal AI assistant is meant to inherit contract data, permissions and citations from a system of record.

The dated primary source

The Sirion and Legora partnership was announced on 14 October 2026 from Lehi, Utah, in a release distributed by GlobeNewswire. That is roughly two weeks before this edition's lookback window, and the date is stated plainly rather than glossed over.

The release was carried by several syndication outlets. The Globe and Mail version carries a standing disclaimer that it contains syndicated third-party content the outlet has not reviewed. That is a sound reason to read the release as a company statement rather than as independent reporting.

What the release commits to

Four commitments are stated explicitly, and all four are architectural rather than promotional.

Bidirectionality. Mutual customers can bring contracts, precedents and the negotiated terms within them from Sirion into Legora to generate legal insights, summaries and contract drafts. In the other direction, lawyers drafting, reviewing or negotiating inside Sirion can draw on Legora's research to check an agreement against case law, legislation and regulation.

A single system of record. Sirion remains the system of record for all draft and executed contracts, with no manual downloading and re-uploading between platforms.

Inherited permissions. The release is unusually direct here. Permissions defined in Sirion carry through to Legora automatically, so users can only see and act on contracts they are already entitled to access. There is, in its wording, no separate permission set to maintain and no approval step to clear before work can begin.

Citations to source. Legora returns research-backed answers with citations and suggested amendments, and every citation links to the exact source passage so lawyers can verify each conclusion against primary law.

The three named voices

Ajay Agrawal, chief executive of Sirion, framed the value around the two halves of the problem: "Strong contracting depends on two things: the full commercial picture and a clear view of the law."

Max Junestrand, chief executive of Legora, described the design intent: "Legora meets legal teams inside the stack they already run, respects the permissions they've set, and takes them from a question about the law to action on a contract without switching platforms."

Patrick Reymann, research director for procurement applications and agents at IDC, made the structural argument: "Legal AI platforms bring the reasoning. Enterprise contract intelligence platforms hold the negotiated commitments."

All three are statements of intent and positioning. None is a measurement.

Why permission inheritance outranks capability

Read the four commitments again and notice which one is hardest to retrofit. Citations can be added to an interface. A system of record can be designated in a contract. Permission inheritance is different.

An assistant that inherits the repository's access model creates no second governance problem. An assistant that maintains a parallel permission set creates a reconciliation task that security and legal operations teams inherit permanently, and that few procurement questionnaires surface.

Trade analysis of the announcement makes the same point from the vendor side, describing the carry-through as removing a separate governance layer that would otherwise slow adoption. That framing is worth holding at arm's length: removing a layer is a benefit only if the inherited layer is genuinely equivalent.

The useful question, then, is not whether a vendor supports permissions. It is whether permissions are inherited or duplicated, and whether revoking access in the source system propagates without a separate administrative step.

A citation is a retrieval record; a speed claim is not

A citation that links to the exact source passage lets a reviewer confirm that the clause relied on exists, is current and says what the answer claims. That is a retrieval record.

A percentage improvement in review time is a capacity claim. It may be accurate and it cannot be reconstructed by a third party. Both have value, but only the first survives an audit, a regulatory inquiry or a challenge to the work product.

This distinction separates a defensible deployment from a persuasive demonstration, and most procurement scorecards still do not capture it.

The rollout language, read carefully

The release states that the integration will roll out in phases, beginning with select beta customers, and that broader availability and additional capabilities will be communicated to mutual customers over time.

That is a phased beta. It is not general availability, and no date for broader release appears in the text. Organisations planning a 2026 deployment should treat the connection as forthcoming rather than shipped.

What remains unverified

Trade coverage of the announcement is explicit about the limits, and they are worth naming precisely.

  • Independent evaluation. No independent assessment of how the integration performs has been published.
  • Beta cohort size. The companies have not disclosed how many customers are in the beta.
  • Commercial terms. Pricing and partnership economics were not disclosed in the release.
  • Scale figures. Legora states it is used by more than 130,000 legal professionals at more than 2,000 law firms and in-house legal teams across over 80 markets. Sirion states it supports more than seven million contracts across more than 100 languages. Both figures come from the companies themselves and are unaudited.
  • Edge behaviour. The release does not describe what happens when a permission is revoked mid-matter, when a contract is superseded while an analysis is open, or when repository metadata and document content disagree. Those are analytical questions, not established defects.

Why this generalises beyond legal work

Most enterprises will never evaluate this specific integration. The pattern applies anyway, because connecting an assistant to a system of record is now routine across finance, procurement, supply chain and operations.

What is not routine is preserving the source system's access model, guaranteeing that a citation surfaces, and keeping a retrievable record of who accepted an output. Those properties live in the integration layer rather than the model. They vary by partner and by release stage, and they are usually invisible in a capability demonstration.

Four questions follow for any buyer. Does the assistant inherit the repository's access model automatically, or maintain a second one? Is a citation guaranteed to surface, or only at a later release stage? When access is revoked at the source, does the revocation propagate? And if a reviewer must reconstruct the source manually, how much time does that add, and who owns the resulting record?

The honest intermediate state

What the Sirion partnership describes is a design intent with sensible architecture: inherited permissions, a designated system of record and citations to primary sources. What it does not yet have is an independent evaluation, a disclosed beta cohort or a general availability date.

That combination is normal for enterprise software at this stage, and it is precisely the combination buyers should be able to describe accurately when they take a deployment plan for approval. Grounding is not a feature you purchase. It is a property you inherit, or fail to inherit, at the connection.

Evidence notes and limits

Evidence was reviewed through material retrieved on 28 October 2026. The Sirion and Legora partnership release is dated 14 October 2026 and was read in full from GlobeNewswire and in syndicated copies from The Globe and Mail and The Manila Times carrying identical text. It sits outside this edition's 36-hour lookback and is included as dated context, clearly labelled.

The OpenAI Legora customer story is dated 28 October 2026 and was available only as a publisher summary, so no figures, percentages or customer outcomes from it are asserted. Trade coverage from LawSnap and Pulse 2.0, and analysis from Disrupts, are secondary sources and are identified as such where used.

All scale figures are company-stated and were not independently audited. The permission, citation and rollout characterisations are quoted or closely paraphrased from the release. The edge-case questions and buyer questions are analysis, not vendor statements. No stock moves, forecasts or future events are presented as completed.