Reference Implementation: Legal Recording Consent

CAA implementation for jurisdiction-sensitive legal queries

Domain Context

Legal advice exemplifies the need for explicit state confirmation:

• Jurisdiction-sensitive: Laws vary dramatically by state/country
• Binary consequences: Recording may be legal or illegal
• Inference danger: "Miami" implies Florida, but inference must be confirmed

This implementation addresses RFC-0002's inferred state authorization rule: in state-sensitive legal domains, inferred jurisdiction is not sufficient for authorization.

Canonical Ontology Object

{
  "canonical_id": "law/statute/recording_consent",
  "domain": "law",
  "sensitivity": "state-sensitive",
  "version": "1.0.0",

  "state_axes": [
    {
      "key": "jurisdiction",
      "type": "validated_free",
      "validation": "^[A-Z]{2}$",
      "description": "US state code (e.g., FL, CA, NY)"
    },
    {
      "key": "jurisdiction_confirmed",
      "type": "boolean",
      "description": "User has explicitly confirmed the jurisdiction"
    },
    {
      "key": "recording_type",
      "type": "enum",
      "allowed_values": [
        "phone_call",
        "in_person",
        "video_conference",
        "voicemail"
      ],
      "description": "Type of communication being recorded"
    },
    {
      "key": "party_count",
      "type": "enum",
      "allowed_values": ["one_party", "two_party", "all_party"],
      "description": "Consent requirement level"
    },
    {
      "key": "recording_party_role",
      "type": "enum",
      "allowed_values": ["participant", "third_party", "law_enforcement"],
      "description": "Relationship of recorder to conversation"
    },
    {
      "key": "business_context",
      "type": "boolean",
      "description": "Is this a business communication?"
    }
  ],

  "required_state": {
    "always": ["jurisdiction", "jurisdiction_confirmed", "recording_type"],
    "conditional": [
      {
        "if": {
          "axis": "recording_party_role",
          "operator": "eq",
          "value": "third_party"
        },
        "then": ["party_count"]
      }
    ],
    "value_constraints": [
      {
        "axis": "jurisdiction_confirmed",
        "operator": "eq",
        "values": ["true"]
      }
    ]
  },

  "authority_requirements": {
    "oracle_required": true,
    "source_registry": {
      "state_oracles": ["state_statute_registry", "legal_database"],
      "evidence_stores": ["legal_query_audit_log"],
      "policy_sources": ["federal_wiretap_law", "state_recording_laws"]
    },
    "verification_method": "policy_check",
    "human_lock_allowed": true,

    "signal_provenance_binding": {
      "consent_requirement": ["state_recording_laws"],
      "federal_baseline": ["federal_wiretap_law"],
      "statute_citation": ["state_statute_registry"]
    },

    "decision_matrix": {
      "default_action": "narrative_only",
      "on_incomplete_state": "block_and_escalate",
      "on_oracle_conflict": "require_human_review",
      "on_high_stakes": "require_human_review",

      "rules": [
        {
          "all": [
            { "axis": "jurisdiction_confirmed", "op": "eq", "value": false }
          ],
          "then": {
            "output_type": "require_human_review",
            "directive_template": "Inferred jurisdiction requires explicit confirmation before legal guidance"
          }
        },
        {
          "all": [
            {
              "axis": "recording_party_role",
              "op": "eq",
              "value": "law_enforcement"
            }
          ],
          "then": {
            "output_type": "narrative_only",
            "directive_template": "Law enforcement recording has complex requirements; consult legal counsel"
          }
        },
        {
          "all": [
            { "axis": "jurisdiction_confirmed", "op": "eq", "value": true },
            {
              "axis": "jurisdiction",
              "op": "in",
              "value": ["CA", "FL", "IL", "MD", "MA", "MT", "NH", "PA", "WA"]
            }
          ],
          "then": {
            "output_type": "triage_directive",
            "directive_template": "Two-party consent state: All parties must consent to recording"
          }
        },
        {
          "all": [
            { "axis": "jurisdiction_confirmed", "op": "eq", "value": true }
          ],
          "then": {
            "output_type": "triage_directive",
            "directive_template": "One-party consent state: One party (including recorder) must consent"
          }
        }
      ]
    }
  }
}

Request Flow Examples

Example 1: Inferred Jurisdiction (RFC-0002 Compliant)

User Input: "I'm in Miami. Can I record my phone call?"

Extracted State:

{
  "jurisdiction": "FL",
  "jurisdiction_inferred": true,
  "jurisdiction_confirmed": false,
  "recording_type": "phone_call"
}

Evaluation:

1. ✓ jurisdiction present (inferred from "Miami")
2. ✗ jurisdiction_confirmed is false (value constraint violation)
3. → Rule triggered: jurisdiction_confirmed = false

Result: REQUIRES_SPECIFICATION

Output:

{
  "kind": "refusal",
  "reason": {
    "code": "inferred_state_requires_confirmation",
    "inferred_values": {
      "jurisdiction": {
        "value": "FL",
        "source": "city_to_state_mapping",
        "confidence": 0.95
      }
    },
    "confirmation_required": ["jurisdiction"],
    "prompt": "I understand you're in Miami. Can you confirm you're asking about Florida recording laws?"
  }
}

Example 2: Confirmed Jurisdiction (Two-Party State)

User Input: "Yes, I'm in Florida. Can I record the call?"

Extracted State:

{
  "jurisdiction": "FL",
  "jurisdiction_confirmed": true,
  "recording_type": "phone_call"
}

Evaluation:

1. ✓ All required state present
2. ✓ jurisdiction_confirmed = true (constraint satisfied)
3. → Rule triggered: FL is in two-party list

Result: AUTHORIZED

Output:

{
  "kind": "measurement",
  "value": {
    "consent_type": "two_party",
    "legal_summary": "All parties must consent to recording",
    "statute_ref": "Fla. Stat. § 934.03"
  },
  "provenance": {
    "oracle": "state_statute_registry",
    "jurisdiction": "FL",
    "last_updated": "2024-07-01",
    "verified_at": "2025-01-02T10:00:00Z"
  }
}

Example 3: One-Party State (Ohio)

User Input: "I'm in Ohio and want to record a business call. Is that legal?"

Extracted State:

{
  "jurisdiction": "OH",
  "jurisdiction_confirmed": true,
  "recording_type": "phone_call",
  "business_context": true
}

Evaluation:

1. ✓ All required state present
2. ✓ jurisdiction_confirmed = true
3. → OH not in two-party list → falls to default one-party rule

Result: AUTHORIZED

Output:

{
  "kind": "measurement",
  "value": {
    "consent_type": "one_party",
    "legal_summary": "Ohio is a one-party consent state. You may record if you are a party to the conversation.",
    "statute_ref": "Ohio Rev. Code § 2933.52"
  },
  "provenance": {
    "oracle": "state_statute_registry",
    "jurisdiction": "OH",
    "verified_at": "2025-01-02T10:00:00Z"
  }
}

Example 4: Third-Party Recording

User Input: "Can I record a call between two coworkers in California?"

Extracted State:

{
  "jurisdiction": "CA",
  "jurisdiction_confirmed": true,
  "recording_type": "phone_call",
  "recording_party_role": "third_party",
  "party_count": null
}

Evaluation:

1. ✓ Most required state present
2. ✗ Conditional requirement triggered: third_party requires party_count
3. → But this is already problematic: third-party recording without participant consent is generally illegal

Result: NARRATIVE_ONLY

Output:

{
  "kind": "narrative",
  "text": "Recording a conversation between other parties without being a participant raises significant legal concerns in most jurisdictions. In California (a two-party consent state), recording others' conversations without their consent may violate California Penal Code § 632. Please consult with a licensed attorney before proceeding.",
  "policy": {
    "grammar_constraints": "attributive",
    "scrub_classifications": true
  }
}

Why Confirmation Is Required

The Miami Problem

When a user says "I'm in Miami," the system can infer Florida with high confidence. But:

1. Miami, Ohio exists (small city, one-party consent state)
2. Miami Beach vs Miami could matter for local ordinances
3. Temporary location vs legal residence may differ

RFC-0002 requires: inferred state must be confirmed in state-sensitive domains.

Two-Party State List

States requiring all-party consent (as of 2025):

• California, Florida, Illinois, Maryland, Massachusetts
• Montana, New Hampshire, Pennsylvania, Washington

This list must come from an oracle, not hardcoded assumptions.

Test Cases (from Adversarial Suite)

Oracle Trust Configuration

const legalOracleRegistry = {
  domain: "law",
  sources: [
    {
      source_id: "state_statute_registry",
      oracle_type: "database",
      trust_tier: "primary",
      domain: "law",
      verification_method: "direct_lookup",
    },
    {
      source_id: "federal_wiretap_law",
      oracle_type: "policy_artifact",
      trust_tier: "primary",
      domain: "law",
      verification_method: "policy_check",
    },
    {
      source_id: "legal_database",
      oracle_type: "database",
      trust_tier: "secondary",
      domain: "law",
      verification_method: "direct_lookup",
    },
  ],
  conflict_resolution: {
    default_strategy: "use_conservative",
    same_tier_strategy: "require_human",
    always_human_axes: ["criminal_liability", "federal_preemption"],
  },
};

Important Disclaimer

This reference implementation is for CAA architectural demonstration only. It does not constitute legal advice. Recording laws are complex, vary by jurisdiction, and change over time. Always consult a licensed attorney for legal guidance.

Files

• Ontology definition: This document
• Test suite: /supabase/functions/tests/legal-ontology.test.ts
• Oracle integration: /supabase/functions/_shared/statute-oracle.ts
• Adversarial tests: /supabase/functions/tests/red-team-vectors.json (tests 005, 014)