First pass legal review of counterparty redlines in Ironclad

When a new document is uploaded to an Ironclad workflow, run a first pass legal review of the counterparty's paper before it lands on my legal team's desk. Trigger this on the Ironclad workflow document webhook event so it runs the moment a new file arrives on a workflow.

Start by calling Retrieve a Workflow with the workflow ID from the webhook payload to pull context: the counterparty name, the contract type, the contract value, and the assigned owner. Hold on to the owner's name and email, I need them at the end.

Then call List Workflow Documents for that workflow and pick the newest counterparty version rather than the original template or an earlier internal draft. Documents come down one at a time by document ID, so once you have chosen the right one, call Download Workflow Document to get its contents.

Before reviewing anything, decide whether the file is actually a negotiated contract. If it is an exhibit, a W-9, a certificate of insurance, a standalone signature page, or any other non-negotiated attachment, stop quietly. Do not post a comment and do not send a Slack message.

For a real contract, compare the key clauses against our standard playbook positions: limitation of liability cap, indemnification, auto renewal and notice periods, termination for convenience, payment terms, governing law, and data protection or security commitments. For each deviation, state what the other side changed, explain in plain English why it matters commercially, classify it as acceptable, worth negotiating, or must fix, and suggest fallback language we could counter with. If one of our playbook positions is missing from the document entirely, treat that as a deviation too.

Post the full findings as a comment on the workflow activity feed using Create Workflow Comment, so the review lives on the contract record itself. Lead the comment with an overall risk level of low, medium, or high, then list the deviations grouped by classification with the must fix items first. Say clearly in the comment that this is an automated first pass and that a lawyer still needs to sign off.

Then send a short message to our legal Slack channel with Send a Message. Keep it to a few lines: counterparty, contract type, overall risk level, how many must fix items there are, and a link to the workflow in Ironclad so people can jump to the full comment. Only tag the assigned owner when there is at least one must fix issue. To tag them, match the owner's email against Slack List Users to get their member ID, and fall back to their plain name if there is no match.

A few practical notes. Build the workflow link from the Ironclad subdomain and the workflow ID. If the Ironclad credential was issued through client credentials, write calls need an actor header of x-as-user-email or x-as-user-id or Ironclad returns a 400, so set one when posting the comment. The scopes this needs are public.workflows.readWorkflows, public.workflows.readDocuments and public.workflows.createComments. Never approve, sign, or advance the workflow. This flags issues for a human to decide on, it does not clear anything.