Automated workflow · n8n + Claude

Contract Clause Risk Review

Every contract gets a first-pass legal read the moment it's submitted — before it sits in someone's inbox for a week. A webhook receives the full contract text, Claude flags the risky clauses and scores overall risk 0–100, and the result is archived and returned immediately.

2
high risk
2
medium risk
2
low risk

What separates low risk from high risk

Claude reads the full contract text and checks it against five clause categories: liability & indemnification, termination & renewal terms, data handling & IP, SLA remedies, and dispute resolution/venue. The risk score is a strict cutoff on how many of those categories carry real one-sided exposure.

Low · 0–39
Medium · 40–69
High · 70–100
12
38
52
65
93
97
Liability & indemnification
Is exposure capped and mutual, or does one side carry all the risk?
Termination & renewal
Can both sides exit on reasonable notice, or is one side locked in?
Data & IP
Who owns what's created or uploaded, and how can it be used?
SLA remedies
Does a real failure get a real remedy, or just a token credit?
Dispute resolution
Is the venue and process fair to both parties?

How a contract moves through it

One straight path from intake to review, then a three-way fork on the result. All three land in the same archive and response.

01 · trigger
Contract Webhook
POST /webhook/contract-risk-review receives the contract name, counterparty, type, and full text.
→
02 · normalize
Normalize Contract Input
Cleans the payload; falls back safely whether fields arrive nested or flat.
→
AI Review Contract
Claude flags risky clauses, scores risk 0–100, then drafts the tier-appropriate action itself — escalation, negotiation email, or approval note.
→
Route by Risk Tier
Routes on risk tier: low / medium / high.
if high
Tag Escalate
Marks the record for the legal team's Slack/email queue.
if medium
Tag Negotiate
Marks the record for the counterparty-email queue.
if low
Tag Auto-Approve
Marks the record for the internal approval log.
Save Reviewed Contract
All three branches converge here — archived to the contracts_reviewed Data Table.
→
Respond With Review
Sends the score, flagged clauses, and drafted action straight back to whatever submitted the contract.

Six test contracts, reviewed live

The contracts below are made-up test agreements, not real deals. The risk scores, flagged clauses, and drafted actions are genuine, unscripted output — each one is what Claude actually produced from running that contract text through the live workflow.

DataVault Cloud Storage Services Agreement
Counterparty: DataVault Systems Inc · Vendor Services Agreement
High
Risk score
97/ 100
Flagged clauses (6)
Limitation of Liability
Vendor's liability capped at $0 while customer's liability is uncapped — a complete elimination of remedy.
Data Handling
Vendor may sell customer data to third parties indefinitely, likely violating GDPR/CCPA.
Indemnification
Customer indemnifies vendor for all claims "regardless of cause," with no reciprocal obligation.
Reasoning
Among the most one-sided vendor agreements possible: a $0 liability cap, a right to sell customer data, asymmetric termination, a 5-day auto-renewal window, and offshore arbitration all compound. No clause offers meaningful protection to the customer.
Automated action · internal Slack/email escalation
#legal-escalationsauto-drafted
🚨 URGENT — Legal Escalation Required: DataVault Cloud Storage Agreement @legal-team / @GeneralCounsel — Please stop the clock on the DataVault Systems Inc agreement. Do NOT sign under any circumstances. Top 3 issues needing immediate attorney eyes: 1. $0 Liability Cap — DataVault has zero financial exposure for any harm, while our liability is uncapped. 2. Customer Data Sale — DataVault reserves the right to sell our customer data to third parties, even after termination. 3. One-Sided Indemnification — we indemnify DataVault for all claims "regardless of cause," with zero reciprocal obligation. This needs fundamental redrafting, not a negotiation. Please advise on next steps ASAP.
Sentinel Security Monitoring MSA
Counterparty: Sentinel Security Corp · Master Services Agreement
High
Risk score
93/ 100
Flagged clauses (6)
Auto-Renewal / Perpetual Term
Rolls in perpetual 3-year terms with no right of non-renewal for either party.
Unilateral Fee Increase
Vendor may raise fees up to 25% annually with 15 days' notice and no customer consent.
Limitation of Liability
Vendor excludes liability entirely, even for gross negligence or willful misconduct.
Reasoning
Nearly every material commercial term is structured in the vendor's favor: perpetual lock-in, uncapped pricing risk, a total liability shield, and no contractual breach-notification timeline for a security vendor. The customer bears essentially all financial, operational, and legal risk.
Automated action · internal Slack/email escalation
#legal-escalationsauto-drafted
🚨 URGENT — Legal Escalation Required: Sentinel Security Monitoring MSA @LegalCounsel — flagging for immediate review. Do NOT execute in its current form. 1. ZERO LIABILITY (incl. willful misconduct) — needs a mutual, capped structure. 2. PERPETUAL LOCK-IN — no right of non-renewal and no termination for convenience. 3. UNILATERAL 25% ANNUAL FEE INCREASES — no consent required, no exit right. Please advise on negotiation posture and whether this vendor relationship should proceed at all. Blocking signature pending your review.
Pinecrest Facilities Maintenance Services Agreement
Counterparty: Pinecrest Facilities Group · Services Agreement
Medium
Risk score
65/ 100
Flagged clauses (4)
Indemnification
Customer must indemnify vendor even for injuries caused by the vendor's own ordinary negligence.
Liability Cap Carve-Out
Personal injury/property damage is carved out of the liability cap, making the indemnity effectively uncapped.
Governing Law
Venue defaults to wherever vendor's principal office is, without naming a state.
Reasoning
Sections 3 and 5 compound each other: the customer indemnifies the vendor for the vendor's own negligence, and that exact category is carved out of the liability cap — creating theoretically unlimited exposure from a single on-site incident.
Automated action · drafted negotiation email
Ridgeline IT Helpdesk Support Agreement
Counterparty: Ridgeline IT Services · Managed Services Agreement
Medium
Risk score
52/ 100
Flagged clauses (3)
SLA / Service Levels
Vendor alone decides which tickets count as "Critical"; most tickets get no response-time guarantee at all.
Auto-Renewal
60-day non-renewal window is tighter than the 30-day market norm.
Limitation of Liability
No carve-out for data breaches or confidentiality violations.
Reasoning
The dominant risk is structural: the vendor controls ticket classification, so the majority of support volume likely gets zero response-time commitment, and the only remedy is a 10% monthly credit — too thin to incentivize real performance.
Automated action · drafted negotiation email
Cedarline Office Cleaning Services Agreement
Counterparty: Cedarline Cleaning Co · Services Agreement
Low
Risk score
38/ 100
Flagged clauses (2)
Limitation of Liability
Property-damage sub-cap of $10,000 per incident sits below the general liability cap.
Auto-Renewal
60-day non-renewal notice requires active calendar management.
Reasoning
A largely balanced agreement — mutual liability cap, mutual indemnification limited to gross negligence, fair termination rights, and customer-favorable governing law. The one real flag is a flat $10,000 property-damage sub-cap, worth a light ask but not a blocker.
Automated action · internal approval note
internal-approval-logauto-drafted
Internal Approval Note — Cedarline Office Cleaning Services Agreement Standard and low-risk overall. Clear to sign, with two minor items to be aware of: 1. Property Damage Sub-Cap: vendor liability for our property is capped at $10,000/incident — fine for routine risk, worth a quick ask to raise to $25,000 if high-value equipment is nearby. 2. Auto-Renewal: calendar a reminder at the 10-month mark to avoid an unwanted 12-month renewal. No legal escalation required. Approved to proceed.
Juniper Consulting Statement of Work
Counterparty: Juniper Consulting LLC · Professional Services Agreement
Low
Risk score
18/ 100
Flagged clauses (2)
Confidentiality
Missing standard carve-outs (public info, independent development, legal compulsion).
Governing Law
Delaware venue is a mild logistical note if client is based elsewhere.
Reasoning
A well-drafted, balanced professional services agreement: mutual liability cap, clean IP assignment on payment, mutual indemnification limited to gross negligence, and fair mutual termination. Nothing rises above low severity.
Automated action · internal approval note
internal-approval-logauto-drafted
Internal Approval Note — Juniper Consulting Statement of Work Risk review complete. No material risk concerns — liability cap is mutual and reasonable, IP assignment is clean, indemnification is mutual and limited to gross negligence/willful misconduct, and termination rights are fair. Two minor items worth a glance, neither a blocker: confidentiality lacks standard carve-outs, and Delaware venue is a minor logistical note. Recommendation: clear to sign. No legal escalation required.

Every tier gets a drafted action, not just high risk

The same AI call that scores the contract also drafts what happens next, matched to the tier: high risk gets an internal Slack/email escalation to legal, medium risk gets a negotiation email addressed to the counterparty, and low risk gets a brief internal approval note. Nothing is left as a bare score — even the cleanest contract above got a real drafted note.

What is contracts_reviewed? It's a Data Table — a lightweight database built directly into this n8n workspace, not a separate external system. It lives inside this n8n project, viewable in n8n's own Data Tables screen and reachable by any other workflow in the same project. It isn't exposed to the public internet on its own — the only way anything outside n8n sees this data is through what a workflow deliberately sends back out, like the drafted actions above.
contract_name counterparty risk_score risk_tier flagged_clauses reasoning
DataVault Cloud Storage Services Agreement DataVault Systems Inc 97 high 6 $0 liability cap, data sale rights, one-sided indemnification, asymmetric termination.
Sentinel Security Monitoring MSA Sentinel Security Corp 93 high 6 Perpetual lock-in, unilateral 25% fee increases, total liability shield.
Pinecrest Facilities Maintenance Services Agreement Pinecrest Facilities Group 65 medium 4 Customer indemnifies vendor's own negligence, effectively uncapped exposure.
Ridgeline IT Helpdesk Support Agreement Ridgeline IT Services 52 medium 3 Vendor-controlled SLA classification leaves most tickets with no guarantee.
Cedarline Office Cleaning Services Agreement Cedarline Cleaning Co 38 low 2 Balanced agreement; one property-damage sub-cap worth a light ask.
Juniper Consulting Statement of Work Juniper Consulting LLC 18 low 2 Well-balanced, standard terms; nothing above low severity.

Going live: what changes outside this demo

Nothing here runs on a manual trigger in production. A real contract has to enter this pipeline the moment it's received, and the result has to land somewhere a person actually sees it — usually a CLM or shared drive.

where contracts already are
Inbox, e-signature tool, or CLM
A contract arriving by email or dropped into a shared drive fires a webhook the instant it's received, carrying the extracted text.
→
unchanged from this demo
This review pipeline
Same normalize → review → draft sequence shown above.
→
write-back
CLM record updated
Risk score, tier, and flagged clauses get written onto the contract record — so anyone opening it sees them, not just this workflow's log.
→
human in the loop
Real Slack/email post + a reviewed draft
High-risk escalations post to a real legal channel immediately. Negotiation emails and approval notes land as a draft for a quick read before sending — not an auto-send.

Why not just use a CLM's built-in AI review?

Tools like Ironclad and DocuSign CLM now ship their own AI-assisted clause review, and at a company that already has one configured well, this workflow isn't a replacement for it.

Where a custom pipeline like this earns its place: native CLM review is often gated behind an enterprise pricing tier, it's tuned to generic playbooks rather than a specific risk rubric, it typically flags clauses without drafting the actual next message, and it doesn't give you a queryable, structured archive you fully own. This build is the shape you reach for when a native reviewer isn't available at your tier, doesn't exist for your document system, or needs rubric logic and messaging specific to your business that an off-the-shelf reviewer can't give you.