Can OpenAI Astra for Law Handle Client Confidentiality? 2026 Pilot Acceptance

A public launch date is not a confidentiality approval: OpenAI’s official Astra for Law documentation identifies September 17, 2026 as the release date and describes initial access for some United States law firms through Trusted Access, ChatGPT, and Codex. OpenAI’s Astra for Law access documentation also says that the API is still coming.

Symptom: Your team sees a legal-specific product, a Zero Data Retention option, and strong research results, then assumes client files can enter the system.

Fastest fix: Treat OpenAI Astra for Law client confidentiality as a controlled acceptance question. Confirm written eligibility and contract scope first, then begin only with approved, traceable, low-risk matters. Test plugins, Codex, and any future API path as separate systems.

This article is for:

• Law firm IT and security leaders deciding which matter data may enter Astra for Law and what evidence to retain.
• Legal technology and platform teams preparing Codex, plugins, or a future API-based legal Agent.
• Partners and innovation leaders choosing between a limited pilot, continued evaluation, or a deployment pause.

Last updated: September 18, 2026. Access status, data controls, and API availability were checked against the Astra for Law help documentation, OpenAI business data guidance, endpoint policy documentation, and related ChatGPT help pages.

Access scope versus assumed availability

The first failure mode is treating a limited release as general availability.

A firm may see a product page, hear that a peer received access, or find a ChatGPT workspace option without having the same entitlement. Separate these conditions:

• Astra for Law is described by OpenAI as initially available to some United States law firms through Trusted Access, ChatGPT, and Codex.
• Your organization may appear eligible to apply without having approval.
• An approved organization may still have individual accounts without the required product entry point.
• A future API announcement would not create a production endpoint in your environment today.
• A model label such as GPT-6 Astra Law should not be treated as an independent access guarantee unless the applicable OpenAI documentation and contract identify it that way.

The evidence package should contain the account or workspace identifier, the visible product entry point, the approval communication, the applicable agreement, and an administrator’s confirmation of scope. Save the capture date and the exact wording. Do not rely on a sales conversation that does not define the permitted data classes, regions, retention controls, or connected tools.

The correct response is a public-materials evaluation when you cannot prove access. Use published opinions, synthetic fact patterns, and documents that do not contain client information. Do not upload matter files merely because the interface accepts them.

Acceptance warning: “Available to selected firms” describes an access condition, not a professional authorization. Your firm still needs its own client consent, confidentiality analysis, information classification, and regional review.

Before the pilot begins, compare the actual entitlement with the intended architecture:

For the next stage, keep a written decision: public evaluation, restricted pilot, or no integration. If any account, contract, or administrator record is missing, remain in the first category.

Zero Data Retention versus a complete confidentiality control

The second failure mode is treating Zero Data Retention as a complete answer to OpenAI Astra for Law client confidentiality.

ZDR addresses a defined data-control condition. It does not replace client authorization, attorney duties, internal classification, legal privilege analysis, records policy, or location requirements. OpenAI’s business data and privacy documentation should be read together with the specific agreement and product settings that govern your account.

Review four separate data surfaces:

• Model training use: whether submitted content is used to improve models under the applicable service terms.
• Abuse and security monitoring: operational records that may exist for safety, fraud, or misuse detection.
• Application state: chats, uploaded files, workspace history, task state, and other product-level records.
• Customer-controlled storage: your document management system, matter database, logs, backups, indexes, and exported results.

A ZDR statement may address one layer while your plugin, logging service, or internal storage creates another. The phrase also does not prove that a file uploaded through every product route receives identical treatment. Confirm the exact entry point, workspace, project, account type, and connected application.

For each data class, preserve:

• The contract clause or service term supporting the control.
• The project-level setting and administrator screenshot.
• The request route, including ChatGPT, Codex, plugin, or API adapter.
• The retention and deletion behavior observed in a controlled test.
• The region and subprocessor information required by your firm.
• The owner responsible for reviewing a policy change.

The answer to whether client files are retained is therefore conditional. A file may be governed differently depending on the product surface, connected service, task state, operational logging, and your own storage. Do not give a categorical “no retention” answer until the complete request path has been tested and documented.

OpenAI’s endpoint data usage policy documentation is useful for checking endpoint-specific treatment. It is not a substitute for the agreement that applies to your organization.

A failed test should trigger a data-class rollback: remove client-identifying material, restrict the pilot to public or synthetic documents, and reopen the contract review. Do not solve an unclear retention path by asking users to be more careful with uploads.

Legal research quality versus a deliverable legal opinion

The third failure mode is turning a correct-looking search result into a client-facing conclusion.

Astra for Law may help locate authorities or organize research. That does not prove that a result is suitable for a specific matter. Your review must test:

• Authority level and whether the source is binding in the relevant jurisdiction.
• Publication status and whether the decision remains valid.
• Date, amendments, later history, and treatment by other courts.
• Adverse authority and exceptions that weaken the apparent rule.
• Whether the cited passage actually supports the proposition.
• Whether the facts in the source match the facts in the matter.

Do not convert a product benchmark or internal validation score into a reliability promise for an individual case. The system can retrieve a plausible authority while missing a later decision, a jurisdictional limitation, or a contrary argument.

For every representative task, retain the prompt, source set, retrieved authorities, quoted passages, lawyer’s review, corrections, and final disposition. Use a fixed evaluation set that includes favorable, unfavorable, ambiguous, outdated, and cross-jurisdiction examples. The reviewer should be able to reproduce why a result was accepted or rejected without trusting the model’s explanation.

If the team cannot independently verify a controlling legal proposition, Astra for Law remains a research aid. It must not become the final source of legal advice, a filing-ready citation generator, or an automated client communication channel.

This boundary also applies to the GPT-6 Astra Law search intent. A model name, legal specialization, or product benchmark does not remove the need for attorney review. Keep model evaluation and matter acceptance as separate decisions.

ChatGPT workspace access versus plugin data paths

The fourth failure mode is assuming that a ChatGPT workspace permission controls every external system connected to it.

A plugin or connected application can introduce separate read, write, cache, authorization, and revocation paths. OpenAI’s documentation on connecting and managing app accounts in ChatGPT should be used to identify how accounts are connected and managed, but your own plugin contract and logs must show what happens to matter data.

Test each operation independently:

• Read-only retrieval from a document management system.
• Search across a matter workspace.
• File upload or preservation.
• Content modification or metadata change.
• Export into chat history or another connected application.
• Revocation during an active task.
• Access after a user leaves the matter or firm.

Do not assume an ethical wall is inherited automatically. Confirm whether matter, client, team, and role boundaries are evaluated by the external system or only by the ChatGPT workspace. Test a user who should see Matter A but not Matter B. A successful denial is evidence; a visually hidden result is not enough.

The acceptance rule is simple: if you cannot explain where the data goes, who can retrieve it, how long it remains, and how quickly access can be revoked, exclude the plugin from confidential matters. Keep plugin testing in a synthetic environment until the path is documented.

The same rule applies to future legal Agent designs. A tool call that looks like a search may create an index, cache a response, write a document, or transmit content to a separate service. Record each side effect instead of treating the plugin as a transparent extension of ChatGPT.

Codex file actions versus model responses

The fifth failure mode is treating Codex as another answer window rather than an execution environment.

Separate these layers:

• Astra for Law or another model generating a response.
• Codex reading or modifying code and files.
• External tools called by the task.
• The operating system account, filesystem, credentials, and network.
• Your firm’s document and matter systems.

A legal workflow that asks Codex to process documents can expose client information to the working directory, temporary files, shell history, logs, task artifacts, backups, and outbound connections. A user’s ChatGPT permission does not automatically define the operating system permission.

Validate the working environment before processing any sensitive sample:

• Create a dedicated workspace that is not shared with ordinary development tasks.
• Confirm the working directory and all temporary locations.
• Use temporary credentials with the smallest possible scope.
• Restrict network egress and record permitted destinations.
• Require human approval before writes, exports, or external tool calls.
• Capture task events and failures without storing unnecessary client content.
• Remove credentials, files, caches, and generated artifacts at task completion.
• Test interruption, timeout, retry, and abnormal shutdown behavior.
• Verify that the generated result cannot cross matter boundaries.

OpenAI provides documentation for archiving and deleting Codex chats. That is relevant to conversation lifecycle, but it does not by itself prove that files, shell artifacts, external tool records, or your own system logs have been removed.

Operational boundary: Never place confidential matter files and ordinary development work in the same Codex workspace merely because both tasks use the same account. Identity, filesystem, credentials, network, and cleanup must be tested separately.

For batch document processing or an internal legal Agent, use an isolated test environment and keep the generated environment separate from the formal document system. If you need a temporary remote Mac for this type of controlled validation, document the separation between the test host and your production repository before reviewing MacPull’s remote Mac environment options.

Future API planning versus a production integration

The sixth failure mode is designing a production legal Agent around an API that has not been made generally available to your team.

The current boundary is that API access is described as coming soon. Do not invent an endpoint, model field, quota, price, region, or release date. Before API availability, you can still build useful preparation:

• Define a provider-neutral adapter layer.
• Classify data before it reaches the adapter.
• Create synthetic and public evaluation sets.
• Specify citation, review, and refusal requirements.
• Define a fallback to manual research or an approved existing workflow.
• Record the minimum evidence required for production approval.
• Design a kill switch and a matter-level disable action.

After the API becomes available to your organization, verify endpoint eligibility, ZDR compatibility, state retention, tool and plugin alternatives, regional handling, rate limits, and the complete cost of each task. Treat each of those as a fresh acceptance item. An API announcement does not prove that the same controls apply to ChatGPT, Codex, or an external connector.

Your final decision should use four evidence groups:

• Contract: access, data controls, regions, retention, and permitted use.
• Accuracy: reproducible legal research results with lawyer review.
• Data path: uploads, prompts, outputs, caches, logs, plugins, and storage.
• Isolation: users, matters, credentials, filesystems, network, and cleanup.

Use the following acceptance checklist before any confidential pilot:

• [ ] The firm has written confirmation of Astra for Law eligibility and the exact enabled product surfaces.
• [ ] The agreement and data controls have been reviewed by the responsible security and legal owners.
• [ ] The selected matter class is approved, documented, and excluded from higher-risk files.
• [ ] ZDR applicability has been confirmed for the exact route, workspace, and task type.
• [ ] ChatGPT, Codex, plugins, and any API adapter have separate data-flow diagrams.
• [ ] Plugin read, write, cache, cross-matter search, and revocation tests are complete.
• [ ] Codex working directories, temporary credentials, network egress, approvals, and cleanup are verified.
• [ ] Representative legal research tasks include adverse authority and later-history checks.
• [ ] Every accepted result has a lawyer review record and correction history.
• [ ] The pilot has a named owner, a stop condition, an incident path, and a rollback procedure.
• [ ] The team can return to public or synthetic data without changing production systems.
• [ ] The final outcome is recorded as public evaluation, restricted pilot, or deferred integration.

If the API is still unavailable, stop at adapter design and evaluation. That is not a failed project. It prevents a prototype from becoming an undocumented production dependency.

Choosing a controlled pilot over an unconditional release

The decision can now be made without relying on the product name.

Choose public-materials evaluation when access is unclear, the contract is incomplete, ZDR applicability is unverified, or the team cannot reproduce the request path.

Choose a restricted confidential pilot only when eligibility, data controls, legal review, plugin boundaries, Codex isolation, and evidence retention are all documented. Start with low-risk approved matters and prohibit automatic client delivery.

Choose deferred integration when the plugin cannot be revoked promptly, the environment shares files or credentials with unrelated work, legal sources cannot be independently checked, or the future API is being treated as available before it is.

The same framework applies if your current plan is a shared Windows or Linux server, a generic cloud workspace, or a local machine. Those options may reduce setup time, but they can leave you with shared credentials, unclear filesystem boundaries, weak teardown, and no clean separation between a legal test and ordinary development work. Buying a dedicated Mac can solve some isolation and macOS compatibility needs, but it is a poor fit when you need a temporary environment, short validation cycles, or several isolated test hosts.

After you confirm the Astra for Law access and data boundaries, continue with a sensitive-file Agent isolation review and document how Codex permissions will be tested before choosing infrastructure. If the pilot needs a disposable remote macOS environment, renting through MacPull can be easier to control than reusing a shared workstation: you can keep the test workspace separate, avoid tying the experiment to a permanent developer machine, and tear down the environment when the acceptance record is complete. It still does not replace OpenAI’s contractual controls or your firm’s confidentiality review.

For client matters, the better outcome is not “enable” or “ban.” It is a traceable decision that states exactly which data may enter, which tools may act on it, who reviews the result, and what happens when any control fails.