The Machine in the Source Code Room
On September 28, 2026, Magistrate Judge Douglas F. McCormick entered a stipulated protective order in Corent Technology, Inc. v. Amazon Web Services, Inc. that does two things that, on their face, point in opposite directions. Section 12.6 pre-approves nine commercial AI products for use with discovery material, including Microsoft Copilot, Westlaw's CoCounsel, Claude, Harvey, and Patlytics. Section 12.5 then bars every AI tool, "regardless of vendor contractual protections," from reviewing, analyzing, or summarizing any material designated as source code. The order puts it plainly: "This prohibition is absolute."[1]
In that case, an enterprise model may summarize every deposition transcript and engineering email in the production, but not one function in the code. The review computer carries the same tension in a single paragraph. Section 4.3.2 directs the producing party to configure the review computer with utilities that include Understand, the SciTools code-analysis program. The next two sentences forbid tools "capable of compiling or executing source code" and any tool "powered by or leveraging artificial intelligence or machine learning that automatically scan, analyze, or provide feedback on source code."[1] SciTools documents that Understand's AI features run on a local model by default and can be pointed at hosted providers such as OpenAI or Anthropic.[2]
The order does not say whether the parties approved Understand with that feature turned off, left local, or connected to a cloud.
Amazon expressly limited its agreement to that case, and a negotiated term binds only the parties who negotiated it.[1] Variations of that structure now appear in orders across the country, and so does its premise: that "AI" is one category a protective order can approve or forbid by name. It is not. A source-code protective order decides which infringement theories a patent owner can afford to test. When the clause governing review software is written in product names and slogans, the order decides that question by accident.
I. Bottom Line Up Front
AI terms have become a regular feature of protective orders. In September, Magistrate Judge Gabriel A. Fuentes observed that court-ordered or party-agreed provisions governing AI use with confidential information "are not uncommon," and collected seven examples from six districts.[3] I reviewed twenty-four orders and rulings entered between December 2025 and October 2026 (Figure 2), together with the precedent they rest on. Five conclusions follow.
First, the orders speak four different languages: absolute bans, approved-product lists, contractual "closed tool" tests, and functional tests that ask what a system actually does. The same product receives opposite treatment depending on which language an order uses. Claude is pre-approved in Corent, listed as fully containerized (as "Claude Enterprise") in White v. Chime Financial, named as an "open or publicly accessible" tool in a Qualcomm supplemental order in the Western District of Texas, and offered as an example of a prohibited service in a Broadcom supplemental order in the Eastern District of Texas (Table 3).[1][4][5][6]
Second, locally hosted models fall into the gaps. Contract tests assume a vendor with terms of service, and a model running on an isolated review computer has none. At least one entered order defines any system whose "underlying models are publicly accessible" as "open," which sweeps in an offline deployment that never transmits a byte.[7] Searching CourtListener, Descrybe, and Filevine's LOIS through October 25, 2026, I found no ruling that squarely decides a contested request to run a locally hosted model on designated source code. The first ones will be decided on the record the parties build.
Third, the unit of approval should be the configured system: what it can read, where it writes, what it transmits, what it keeps, and what it can execute. The Broadcom order in Wilus Institute v. HP comes closest. It prohibits any AI system that "transmits user inputs or outputs outside the user's local computing environment," "stores inputs or outputs beyond the active session," or "uses inputs or outputs for model training, fine-tuning, evaluation, or product improvement."[6] That is a test an engineer can verify.
Fourth, the burden on both sides is evidence. The Fifth Circuit requires "a particular and specific demonstration of fact as distinguished from stereotyped and conclusory statements."[8] Courts have refused to treat an offline computer as a substitute for a description of what will run on it, and the District of Kansas refused to credit a cost objection that the objecting party never quantified.[9][10][11] A restriction built on case-specific facts can also fall when those facts change, as the amended order in Jeffries v. Harcros Chemicals did in July.[11]
Fifth, the audit trail that proves compliance can also expose strategy. Source-code orders already draw the right line: a producing party may log who connected and when, but not what the reviewer looked at, typed, or noted.[12] AI protocols should keep that line.
A note on scope and currency. This article addresses federal civil litigation. Orders, product documentation, and vendor terms change quickly; I reviewed every authority and technical source cited here through October 25, 2026. The provisions in Part VIII are drafting recommendations, not rules any court has adopted.
The article proceeds in eight further parts. Part II explains why the operative order, and the procedural posture it creates, controls everything else. Part III maps the four vocabularies and shows where they collide. Part IV follows the data through a local review system, component by component. Part V explains why a no-training clause does not answer the retention question. Part VI addresses agents that can act on the files they read. Part VII separates compliance auditing from discovery of work product. Part VIII offers model provisions. Part IX describes the record that wins the motion.
II. The Order You Have Is the Order That Binds
Source code can embody valuable trade secrets. The federal definition reaches "programs" and "codes" when the owner has taken reasonable measures to keep them secret and they derive independent economic value from not being generally known.[13]
A confidentiality legend does not establish those elements. Rule 26(c)(1)(G) separately authorizes orders protecting "a trade secret or other confidential research, development, or commercial information," so not every protected item must satisfy the statutory definition.[14]
Both sides start with a real interest. The producing party may protect against copying, unauthorized disclosure, and reuse, and it need not wait for a leak to ask. A reviewing expert's good intentions cannot repair disclosure of a competitor's implementation, and a vendor's promise does not bind every system that touches the data. The receiving party's interest is just as concrete. Rule 26(b)(1) makes the importance of the issues, the parties' relative access to relevant information, their resources, and the burden of the discovery part of proportionality.[14] A restriction that multiplies the hours needed to trace an accused function through a large repository has a cost, and that cost falls on the party with less access to the code. The rule does not guarantee the cheapest method or a party's preferred software, but it does require the court to count the cost.
The Supreme Court leaves that balance to the trial judge: "Rule 26(c) confers broad discretion on the trial court to decide when a protective order is appropriate and what degree of protection is required."[15]
In the Fifth Circuit, the discretion runs on facts. In re Terra International, Inc. granted mandamus against a witness-sequestration order because the movant "did not support its motion for protective order with any affidavits or other evidence," and held that good cause "contemplates a particular and specific demonstration of fact as distinguished from stereotyped and conclusory statements."[8] Terra concerned the sequestration of deposition witnesses, not software. Its lesson travels anyway: prove the risk. It does not require proof that a feared disclosure has already happened.
Patent law supplies the closer analogy, and it repays attention. In re Deutsche Bank Trust Co. Americas explained why protective orders sometimes bar litigators from prosecuting patents: "[I]t is very difficult for the human mind to compartmentalize and selectively suppress information once learned, no matter how well-intentioned the effort may be to do so."[16] The Federal Circuit then required the party seeking a bar to show that the information that triggers it, the activities it prohibits, its duration, and its subject matter "reasonably reflect the risk presented by the disclosure of proprietary competitive information."[16] The Ninth Circuit's formulation in Brown Bag Software v. Symantec Corp. is just as direct: proper review of a protective order "requires the district court to examine factually all the risks and safeguards surrounding inadvertent disclosure by any counsel, whether in-house or retained."[17]
Deutsche Bank is a prosecution-bar decision, not an AI holding. Its premise nonetheless maps onto the technology with unusual precision, and Part V returns to it. A model whose parameters were fine-tuned on a competitor's code is the mind that cannot compartmentalize. A model with frozen parameters that reads code through a retrieval index is in a different position, because what it "remembers" sits in files that can be inventoried, segregated, and destroyed. The right restriction depends on which system is in the room.
Bottom line: an AI restriction, like a prosecution bar, should reasonably reflect the risk the specific system presents, and the party seeking the restriction or the permission should prove its position with facts.
A. Posture decides the standard
A request to use a tool under an existing approval clause differs from a request to modify an express prohibition. The first follows the order's notice-and-objection procedure. The second requires a motion to modify, and federal courts in Texas evaluate "(1) the nature of the protective order, (2) the foreseeability, at the time of issuance of the order, of the modification requested, (3) the parties' reliance on the order; and most significantly (4) whether good cause exists for the modification."[18] A party that stipulated to an absolute ban at a time when AI-assisted code review was plainly foreseeable will find the second and third factors running against it.
Three 2026 decisions show how much weight courts give the negotiated record. In STT WebOS, Inc. v. ByteDance Ltd., a patent case transferred from the Eastern District of Texas with a stipulated order already in place, the plaintiff asked to start over with the Northern District of California model. Magistrate Judge Susan van Keulen saw "no principled reason or rule that would require the Parties to start over and renegotiate a protective order at this stage of the litigation," and adopted the defendants' version of the model, edited to preserve the negotiated terms.[19] The order entered on August 4 bars use of any produced material "for prompts (inputs), completions (outputs), or embeddings that are used to train, improve, re-train, or otherwise develop" AI models.[20]
In In re MultiPlan Health Insurance Provider Litigation, Judge Matthew F. Kennelly entered a source-code order under which providing source code to "any artificial intelligence tool or platform" is "strictly and absolutely prohibited," but entered it without prejudice to the plaintiffs' ability, "upon a specific and particularized showing of need," to seek an amended order "following source code inspection."[21] And in Jeffries v. Harcros Chemicals Inc., Magistrate Judge Angel D. Mitchell extended AI limits to all discovery in March, District Judge Kathryn H. Vratil overruled the plaintiffs' objection in June but remanded because "the discovery environment in this case has materially changed," and Judge Mitchell vacated the amended order in July at the parties' joint request.[11]
Bottom line: the time to negotiate the AI clause is before the stipulation, and the time to build the record for changing it is during the first inspection.
B. Silence is not permission
An order that never mentions AI may still reach it. In Morgan v. V2X, Inc., Magistrate Judge Maritza Dominguez Braswell noted that a general bar on disclosure means "'disclosure' in the form of transmission to an AI system with a provider that stores the Confidential Information in their own databases, and/or for their own purposes, may violate the current Protective Order."[22] Source-code orders add tool-approval clauses on top of that. Loading protected code into a new tool without the approval the order requires is a compliance problem, however secure the setup.
The Northern District of California illustrates the hierarchy. Patent Local Rule 2-2 provides that the court's model protective order "shall govern discovery unless the Court enters a different protective order." The source-code section of the court's patent model, marked optional, calls for review "on a secured computer in a secured room without Internet access or network access to other computers," with limited paper printouts.[23] The model says nothing about AI. Its provisions are drafting references. STT WebOS shows that even in that district, a negotiated order displaces the model.
III. Twenty-Four Orders, Four Vocabularies
The orders do not show a trend toward permitting or prohibiting AI. They show four different ways of asking the question, and the vocabulary an order uses determines how a locally hosted model fares under it. Some orders resolve contested motions; most embody negotiated terms that bind only their parties. Figure 2 places them in time, and Table 1 records what eight of them do and do not establish.
Table 1. Selected orders and the limits of what they establish
Order and posture | Operative treatment | What it does not establish |
Bars processing protected information with generative AI "available to the public" where the information is used to train the model or is retained after the litigation. The court chose this language over the defendants' proposal to bar generative AI except as the producing party agreed. | Reasons for the choice, a rule for source code, or a holding about tools that are not available to the public. | |
Amended a stipulated order so confidential information may go only to AI providers contractually barred from training on or storing inputs and from disclosing them to third parties, with deletion rights and written documentation. Ordered the pro se plaintiff to name the tool he had used. | A universal zero-retention rule, a blanket waiver of AI work product, or approval of any source-code system. | |
Extended AI safeguards to all discovery, including undesignated material, permitting closed tools and barring open ones, on critical-infrastructure and data-privacy grounds. Vacated on joint request after most defendants were dismissed and the district judge remanded for changed circumstances. | A continuing rule even in that case, that undesignated production is public, or that the order barred all AI-assisted review. | |
Section 14.5 bars using any produced material, including source code, in prompts, completions, or embeddings that train, improve, re-train, or develop AI models, whether proprietary, open-source, or third-party. | Affirmative permission to run local analysis. The source-code access provisions still govern. | |
Permits AI use with all discovery material on enterprise terms, pre-approves nine products, and allows matter-specific retention. Separately bans AI processing of designated source code and AI review utilities on the source-code computer. Amazon limited its agreement to that matter. | A contested holding that every local model is unsafe, or general approval of every configuration of a listed product. | |
Defines "fully containerized" by retention, training, and use in other matters. Names example services on both sides of the line and requires deletion of protected material and derivative information. | That a brand name, or ordinary software containerization, satisfies the definition. | |
Allowed nonstenographic recording of depositions but refused to compel the opposing party to submit to real-time AI analysis, because the proponent could not explain the platform's model providers and data terms. | That AI deposition tools are improper. The court confined its ruling to the parties' submissions. | |
Absolutely prohibits providing source code to any AI tool, without prejudice to a later request on a specific and particularized showing of need after inspection. | That the prohibition is permanent, or that a record-based request will fail. |
A. Absolute bans
Corent section 12.5 and MultiPlan paragraph 5(i) prohibit any AI processing of source code.[1][21] They are clear and easy to police, and parties are free to trade for them. They also end the inquiry before it starts: a model that runs on the review computer, transmits nothing, keeps nothing, and cannot execute anything is barred in the same words as a consumer chatbot. As a negotiated bargain, that is a choice. Imposed over objection, it would need the particularized showing Terra requires, and MultiPlan itself anticipates a later, record-based request.
B. Product lists
Corent section 12.6 approves nine named products "when used at the enterprise or commercial tier identified below and subject to the configuration requirements in this subsection," and each approval comes with conditions, such as disabling consumer connectors and web-grounding features.[1] White v. Chime Financial takes a definitional route and then illustrates it with names. A "fully containerized" tool is one that does not retain the substance of a prompt or documents reviewed, share it for training, or use it in any other matter.[4] The order then lists "OpenAI, Gemini, LLAMA, MidJourney, and Stable Diffusion" among the non-containerized systems it restricts, and lists "Claude Enterprise" and "Gemini Pro and Ultra" among the services that may be used in a fully containerized environment.[4]
The list and the definition point in different directions. Llama is a family of models with publicly released weights. Run on an isolated review computer that saves no history, it would satisfy each element of White's own definition of "fully containerized," yet the order names it as an example of what it restricts. White does get one thing right: the receiving party must be able to delete protected material at the end of the case, "including any derivative information stored within the tool."[4]
C. Contract tests and the two meanings of "closed"
The most common vocabulary asks whether the provider is bound by contract. Morgan permits AI use with confidential information only if "the AI provider is contractually prohibited from" storing or using inputs to train or improve its model and from disclosing inputs to third parties, with a contractual right to delete and written documentation of those terms.[22] The Qualcomm supplemental order entered in Cobblestone Wireless v. Apple bars "open or publicly accessible" tools, "including ChatGPT; Claude; Gemini," and allows a "Closed AI Tool" that is "maintained in a private single tenant or behind a firewall," subject to deletion of "residual information," access limits, and a no-training rule.[5]
The same language has already reached source code itself. In an International Trade Commission investigation, Administrative Law Judge Monica Bhattacharyya entered, on an unopposed motion, a source-code addendum providing that a third party's source code "may only be submitted to an AI Tool that is maintained in a private single tenant or behind a firewall," subject to the same deletion, security, and no-training conditions.[25] The stipulated order in Daedalus Prime v. Google adds a sentence many orders omit: the conditions "apply equally to any downstream third-party tools or services integrated with the Confidential AI Tool."[26]
That sentence travels as part of a template. The same "Confidential AI Tool" clause, downstream-tools sentence included, appears in stipulated orders entered between May and July 2026 in Daedalus Prime v. Marvell and Network System Technologies v. Marvell in the Western District of Texas, Array Cache v. MediaTek in the Eastern District of Texas, and Glean IP v. Glean Technologies in the Northern District of California.[27][28][29][30] The variations matter more than the template. Array Cache and Network System Technologies provide that the clause does not reduce the order's separate source-code provisions, which leaves open whether a qualifying AI tool may ever touch code confined to a review computer.[29][28] Network System Technologies also lets the tool's providers access protected material "as necessary to provide the Services."[28] Glean adds conditions a local deployment may not meet: it bars any tool "that is not an enterprise version, hosted in the United States and does not have a zero data retention policy."
An open-weight model running offline on a review computer retains nothing outside the review environment, yet it is not an "enterprise version" of anything.
Two problems follow for local deployments. First, a contract test presumes a vendor. A model running on the review computer has no data processing agreement, but it also has no provider who receives the data. Morgan's text does not fit that case; Qualcomm's "behind a firewall" language does. A stipulated order in Velez v. One Plus Technology (Shenzhen) Co. shows the mismatch inside a single paragraph. It names "self-hosted language models" among the permitted systems, then conditions every permitted platform on the user having "a good-faith basis to believe the platform contractually prohibits use of the information for generalized model training or other benefit to non-parties."[31]
For a model the receiving party runs itself, no counterparty exists to make that promise. The question that matters is whether the system trains on the material at all, and that question has a technical answer. Second, "open" carries two meanings. In 5000 Plus LLC v. Majestic Steel USA, an "open AI system" is one "for which the source code, training data, or underlying models are publicly accessible."[7] That definition is about publication, not data flow. It treats a model with public weights running offline as "open," while a public chatbot built on secret weights could qualify as "closed" if it meets the order's safeguards. The word means "public service" in one order and "public weights" in the next.
Morgan also shows why a label cannot carry the argument. The pro se plaintiff there proposed that AI tools "operate within a secure, closed-circuit environment." The court rejected the proposal because it "seems to address cybersecurity concerns about unauthorized access rather than the distinct risks associated with today's widely available AI platforms," and adopted conditions that apply "regardless of the sophistication or apparent trustworthiness of the tool."[22]
D. Functional tests
The Broadcom order in Wilus asks three questions an engineer can test: does the system transmit outside the local computing environment, does it store inputs or outputs beyond the active session, and does it use them for training, fine-tuning, evaluation, or product improvement.[6] It names familiar services as examples, but the examples illustrate the test instead of replacing it, and it requires each party to "implement reasonable technical and administrative safeguards to enforce this restriction." The stipulated source-code order in Doe I v. Google uses a similar floor, requiring safeguards that at minimum prohibit use of protected material in AI services "that are accessible to the public or will capture entered data in order to train what is accessible by the public."[32]
The clearest head-to-head choice between vocabularies came out of Austin. In In re Agilon Health, Inc. Securities Litigation, the parties agreed on every term of their protective order except one. The defendants proposed that protected information "shall not be processed using generative artificial intelligence except as specifically agreed to by the producing party." The plaintiffs proposed a floor: protected information "shall not be processed using generative artificial intelligence available to the public where the protected information is used to train the generative artificial intelligence model or is retained beyond the conclusion of the litigation."
Magistrate Judge Susan Hightower entered the plaintiffs' language the next day.[24] The order gives no reasons, and Agilon is a securities case about documents, not source code, so it is a data point rather than a precedent. The choice still matters. The court declined to give the producing party a veto over the receiving party's tools and adopted a test keyed to what happens to the data. By its terms, the clause does not reach a model that is not available to the public, which is exactly where a locally hosted model sits, although the order's general use and storage limits still apply to it.
Functional tests travel best, but they still force a policy choice. Wilus's session limit would bar a persistent retrieval index, which Corent section 12.7.2 expressly allows for cloud tools so long as it stays in "a single matter-specific workspace" and does not train the model.[6][1] Neither choice is wrong. Each should be made on purpose.
Table 2. How each vocabulary treats a locally hosted model
Vocabulary | Representative terms | Question the order asks | How a locally hosted model fares |
Absolute ban | Is it AI? | Barred, whatever the configuration. | |
Product list | Is the product listed, at the right tier? | Usually unlisted. White names LLAMA among the restricted examples. | |
Contract or "closed" test | Cobblestone ¶ 39 [5] Certain Integrated Circuits (ITC) ¶ 22.C(iv) [25] Array Cache ¶ 22 [29] Network System Technologies § 14.10 [28] | Is a provider bound by contract, or is the system "closed"? | Uncertain. No vendor contract exists. "Behind a firewall" language fits; "publicly accessible" model language cuts against it. |
Use restriction (training only) | Is produced material used to train or develop a model? | Compatible if parameters stay frozen, but silent on retention and export. | |
Functional test | Does the system transmit, persist, or train? | Permitted if isolation, session limits, and no training are shown. Outside Agilon's text, which reaches only tools available to the public. Persistent indices need express treatment. |
Table 3. One product, opposite treatment
Product | Treated as permitted | Treated as restricted or "open" |
Claude | ||
Gemini | ||
Microsoft Copilot | ||
ChatGPT | ||
Llama and other open-weight models |
In Corent, section 12.5 overrides every approval in this table for designated source code.
Bottom line: draft in the functional vocabulary, and use product names only as nonexclusive examples tied to a stated configuration.
IV. Follow the Data Through the Entire System
Cloud versus local is an important distinction, but it is one dimension of several. A local text-generation tool and a local agent with shell access can run the same model and present very different risks. Retrieval, embeddings, and logging are functions either system may use. They are not mutually exclusive categories, and they do not rank neatly from low risk to high.
Start with the components. The model generates output. A runtime loads and serves it. A retrieval component supplies selected material. An application presents the interaction, and an agent may invoke tools that read files, execute commands, or write results. Each component can have its own settings and its own storage. Approval should describe the combination.
Ollama's official documentation makes the configuration issue concrete. Ollama runs models locally but also offers cloud models and web search. Its documentation explains that it "can run in local only mode by disabling Ollama's cloud features," through a server setting or the OLLAMA_NO_CLOUD environment variable, and that it "binds 127.0.0.1 port 11434 by default."[33] Those facts support a local deployment proposal. They do not prove that a particular installation has disabled cloud use, bound only to the loopback address, or kept other installed software from communicating.
Cline's documentation explains how to connect its coding assistant to a local Ollama runtime.[34] That permits local inference. It says nothing, by itself, about the permissions or isolation of the surrounding agent, editor, extensions, or operating system. "We use a local model" leaves most of the system undescribed.
The same problem now reaches familiar code-analysis tools, which is why Corent's Understand clause matters in practice. SciTools documents that Understand "installs and runs on a machine with no internet access," that each feature able to reach out (online licensing, update checks, analytics, AI model download, and cloud AI) is optional, and that its AI stays on a bundled local model unless a user switches to a hosted provider.[2] An order that requires Understand on the review computer and bans AI tools that "analyze, or provide feedback on source code" needs to say whether Understand's AI must be switched off, and if not, which configuration it authorizes.
The vendor chain deserves the same scrutiny. In MFB Fertility, Inc. v. Action Care Mobile Veterinary Clinic, LLC, a party asked the court to compel its opponent to sit for depositions recorded through a platform whose optional AI features "run on Anthropic's enterprise API." The opposing party counted "at least five vendors" in the data path, including Zoom, Recall, AWS, Box, and Anthropic.[3] Judge Fuentes allowed nonstenographic recording but refused to compel the AI features, because the briefing "left the Court with more questions than useful answers" and did not make clear whether the platform relied on third-party models "which have their own policies on the use and deletion of uploaded materials."[3] The court would not order a party "to subject itself blindly" to the tool.[3] Daedalus's downstream-tools sentence exists for this problem.
Table 4. Review the configuration against the function it performs
Function | Question to resolve | Proposed control |
Remote processing | Which services or people receive protected input, context, or output, including downstream providers? | Express authorization; applicable contracts; verified endpoints and retention settings. |
Local inference | Do all model and supporting operations remain inside the approved boundary? | Preinstalled components; disabled external paths; local-only configuration tested in operation. |
Agent actions | Can the system execute commands, modify files, or invoke external tools? | Read-only source; constrained working storage; independently enforced permissions. |
Retrieval and memory | Where do source chunks, vectors, metadata, histories, and snapshots persist? | Inventory and segregate stores; protect derivatives; implement clawback and disposal. |
Exports and auditing | What leaves, through which path, and who can inspect revealing records? | Controlled release of necessary outputs; limited compliance reports; protected review of detailed logs. |
For a proposed offline system, identify the full chain of processing before claiming that no outside provider receives the code. Include embedding generation, transcription or optical character recognition if used, license verification, diagnostic uploads, crash reports, editor extensions, and support access. A local front end can still call a remote service.
The boundary must also be usable. If the application communicates with a model server on the same computer, the order should permit that specified loopback connection while forbidding external communication. A literal ban on every form of networking can prohibit the very architecture the parties meant to approve.
Bottom line: approve a configuration schedule, not a product, and require the proponent to trace every path the data can take.
V. Frozen Weights, Persistent Files
Ordinary inference with fixed model parameters does not update those parameters. That proposition is narrower than saying the system cannot learn from, remember, or retain the review. An application can save conversation history, retrieve earlier results, or write files without changing the underlying model. A no-training clause therefore addresses one part of the confidentiality problem.
This is where Deutsche Bank earns its place. Prosecution bars exist because a human reviewer cannot unlearn a competitor's design. A no-training clause addresses the machine version of that problem: once protected code shapes a model's parameters, no one can reliably extract it. The District of Kansas credited that concern in Jeffries, accepting that data submitted to an open tool that trains on it cannot practically be clawed back (the parties later agreed to vacate that order).[11] A frozen model is in a better position than a human expert in one respect. Its parameters do not change, and everything it retains sits in identifiable storage. The retention problem for a frozen model is a problem of files, and files can be found.
Retrieval-augmented generation, or RAG, builds a model's context at runtime from a document store, often a vector database.[35] That store may hold source passages, metadata, embeddings, or all three. Embeddings are numerical representations used for tasks such as similarity search. They should not receive an automatic exemption because they are numbers or do not resemble the original code. The order should address the information they encode and the material stored beside them.
One documented example makes the point without speculation. Cline's checkpoint feature keeps a separate shadow Git repository of project snapshots that persists across editor sessions, and the documentation describes it as enabled by default.[36] A review that checks only whether model weights changed will miss those copies.
Courts are already wary of persistence on the review computer, AI or not. In Philips North America LLC v. Global Medical Imaging, LLC, the defendants asked for the right to "store scripts and data output by those scripts or other tools" on the source-code computer to speed later inspections, arguing that security concerns were illusory because the computer was not networked. Magistrate Judge Sheila M. Finnegan refused: "With the minimal information provided, the Court is unable to confirm the claim that there is 'no plausible risk' to the source code," and "it seems at least possible that allowing experts to store and use unidentified tools and scripts on a source code computer could create security concerns."[9] A persistent retrieval index is a stored output of a tool. The proponent should expect the same question and answer it in advance.
A cryptographic hash can confirm that a specific file matches a trusted baseline. It cannot show that other files contain no source code, that no adapter was created, or that a cache, checkpoint, or exported archive is clean. The baseline and the verification process must themselves be trustworthy. An unchanged model file is evidence about that file.
That distinction should change the exit procedure. If an unmodified public model is needed elsewhere, downloading a fresh copy from its trusted distribution is simpler than proving that a package leaving the review environment contains only clean files. Case-specific runtime directories, histories, indices, and snapshots stay inside the agreed disposal and preservation process.
Bottom line: a no-training clause is necessary and insufficient. The order must also inventory, protect, and dispose of every store a review session writes.
VI. Offline Is Not the Same as Harmless
Disconnecting a machine from external networks removes the ordinary routes to an outside service. It does not stop an agent from altering writable files, producing misleading results, or placing protected information somewhere that will later be exported or backed up. The question is what the software can do with the permissions it receives.
Cline's documentation describes approval settings for reading files, editing files, running terminal commands, using a browser, and calling external tools. It also states that "Cline does not use a fixed allowlist" to decide which commands are safe; instead, "[t]he model marks each command with a requires_approval flag based on the command and arguments."[37] A proposal that relies on that classification should not describe it as an independently enforced command allowlist.
For protected source-code review, I would start with a read-only source tree, a separate writable analysis area, and denied access outside approved directories. Permit only the commands and arguments the proposed analysis needs. Restrict subprocesses and external tools as well as the visible application. Human approval is useful, but a rushed click should not be capable of granting permissions the order prohibits. Enforce the important boundaries outside the model.
Prompt injection is the integrity version of the same problem. The National Institute of Standards and Technology reports that instructions planted in material a system ingests can make it "produce arbitrarily incorrect summaries of sources" or redirect an agent to "a malicious, attacker-specified task instead of (or in addition to) its intended, user-provided task," and that hijacked agents can "execute arbitrary code or exfiltrate data from the environment in which they are operating."[35] Applied to code review, a repository comment or document can become an instruction channel if the system treats its contents as commands. That is a threat model, not an accusation that any party has planted instructions.
Removing internet access does not make a misleading summary accurate. Keep produced material separate from governing instructions, restrict permitted actions, and verify substantive conclusions against the code. If the analysis requires compilation or execution, ask for that permission specifically. Courts treat execution as a separate request with separate risks. In R2 Solutions LLC v. Databricks, Inc., the plaintiff argued that compiled code "would be confined to the stand-alone, non-networked computer just like all of the un-compiled source code." Judge Amos L. Mazzant III disagreed, citing "the security risk in executing the code in an atypical network environment," and held that "source code in its electronic native format suffices."[10] Corent likewise forbids installing tools "capable of compiling or executing source code" on its review computer.[1]
R2 contains the sentence every producing party will quote against an AI request: under the plaintiff's approach, the defendant "would incur risk and expenses to reduce the effort necessary for Plaintiff to substantiate its infringement theory."[10] The answer is not to deny the efficiency gain. It is to propose a configuration that adds no execution capability, places no burden on the producing party, and shows the court the analytical benefit on a representative task.
Absolute assurances make these disputes harder to resolve. "The machine is offline" should introduce the evidence of isolation and permitted outputs. It cannot replace that evidence, and after Philips no one should expect a court to accept it alone.
VII. Verify Compliance Without Discovering Strategy
An audit trail can protect both sides, but a division between "system logs" and "content logs" is too crude. A file-access log can reveal the modules counsel considers important. A command line can contain a claim term or an infringement hypothesis. A record of deleted files can expose an abandoned theory. Removing the prompt text does not necessarily remove the work product.
The law already protects this kind of selection. In Sporck v. Peil, the Third Circuit held that counsel's "selection process" in grouping documents "out of the thousands produced in this litigation" is protected work product because identifying the group would reveal counsel's mental impressions.[38] Source-code orders have long drawn the matching line. Corent lets the producing party log each reviewer's name, the date and time of access, its length, and whether pages were printed.[1] The stipulated order in MasterObjects, Inc. v. Amazon.com, Inc. lets the producing party "log all connections," but provides that it "will not log or monitor what is being reviewed on the source code computer's screen," view notes, or log keystrokes, and will not "otherwise attempt to record the Receiving Party's work-product."[12]
One of the 2026 AI clauses draws a similar line for the AI tool itself: "information derived therefrom" excludes data "relating to usage tracking, performance statistics, system logs, or other administrative metadata that does not reveal the substance or content of any Protected Material."[28] Who and when go to the producing party. What and why stay with the reviewer.
The early AI privilege decisions fit that structure. Morgan recognized that Rule 26(b)(3) protects litigation preparation involving AI, but required the pro se plaintiff to name the tool he used with confidential information because he "has not carried his burden" to show that naming it would reveal his mental impressions, and because "Defendant is entitled to know which system."[22] In Warner v. Gilbarco, Inc., Magistrate Judge Anthony P. Patti refused to compel a pro se plaintiff's AI materials, holding that work-product waiver requires disclosure "to an adversary or in a way likely to get in an adversary's hand," and that ChatGPT and similar programs "are tools, not persons."[39] In Concord Music Group, Inc. v. Anthropic PBC, Magistrate Judge van Keulen, applying her earlier rulings in the case, treated the publishers' prompts and related settings as opinion work product because they reflect "queries crafted by counsel," a phrase that traces to Tremblay v. OpenAI, while counts of prompts and responses are "at best[] fact work-product."[40]
The leading contrary decision is narrower than its reputation. In United States v. Heppner, Judge Jed S. Rakoff held that a criminal defendant's exchanges with Claude were neither privileged nor work product. The defendant used a publicly available AI platform on his own initiative, the governing privacy policy permitted training on inputs and disclosure to third parties, and counsel "did not direct [Heppner] to run Claude searches."[41] Judge Rakoff added that if counsel had directed the use, the tool "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent."[41] A counsel-directed review on an isolated system with no third-party retention sits on the opposite side of both facts that drove Heppner.
Later courts have read Heppner just as narrowly. Morgan found it distinguishable on two grounds: it was a criminal case, while "the text of Rule 26(b)(3) broadly protects the work product of a party, not merely counsel," and a pro se litigant has no "gap between the party and the attorney."[22] A New York trial court then quashed subpoenas to OpenAI for a pro se litigant's AI records, finding "the rationale presented in Morgan persuasive."[42]
Discovery aimed at a party's own AI-assisted review has met resistance as well. In Agilon, the plaintiffs moved to compel disclosure about the defendants' use of Relativity aiR, a generative-AI review tool, to identify documents for production, complaining that the defendants would not provide "any meaningful information about the criteria, validation, or scope of that process." The defendants answered that the demand for "prompt criteria, scoring thresholds, validation design, and internal review workflow targets attorney work product." Judge Hightower denied the motion for reasons stated from the bench.[43] The order has no written analysis and concerns a producing party's responsiveness review rather than a receiving party's code analysis, so it shows an outcome, not a rule.
Table 5. How courts have treated AI artifacts in discovery
Artifact | Treatment | Authority |
Counsel's prompts and related settings | Opinion work product. | |
Counts and statistics about those prompts | At best fact work product; discoverable when fairness requires. | |
Prompts and outputs used by a testifying witness who puts the investigation at issue | Discoverable, including negative results. | |
Criteria, thresholds, and validation behind a producing party's generative-AI responsiveness review | Motion to compel disclosure denied, for reasons stated from the bench. | |
Identity of the AI tool used with confidential information | Discoverable absent a showing that naming it reveals mental impressions. | |
A pro se party's AI-assisted materials | Work product; using an AI tool is not disclosure to an adversary. | |
A pro se party's AI records sought from the AI provider by subpoena | Work product; subpoenas quashed. | |
A represented defendant's own consumer-AI documents, made without counsel's direction | Neither privileged nor work product. | |
The producing party's record of source-code review | Who connected and when; not screen content, notes, or keystrokes. | MasterObjects [12]; Corent § 4.3.6 [1] |
I would separate routine compliance reporting from investigative access. The producing party receives a configuration inventory, integrity checks, confirmation that external connections are disabled, and notice of boundary violations. Detailed prompts, outputs, file selections, and command arguments stay out of routine adversary inspection, subject to whatever privileges and discovery obligations actually apply. A neutral examiner can investigate a specific compliance concern under an agreed protocol or court supervision.
A. Testifying experts are different
Rule 26(a)(2)(B) requires a testifying expert's report to disclose the opinions, their bases, and the facts or data considered. Rule 26(b)(4) protects drafts and most attorney-expert communications, with express exceptions for compensation, facts or data counsel provided that the expert considered, and assumptions counsel provided that the expert relied on.[44] Those provisions do not create a blanket privilege for everything an expert types into a model or receives from it.
Concord shows where the line moves once a witness testifies. Because the publishers intended to call their investigator to describe prompts that produced infringing output, the court ordered production of all prompts and outputs, positive and negative, that investigators and client witnesses submitted in the post-suit investigation, while protecting attorney prompts that never reached a testifying witness. The court's prior order put the principle in one line: "if Publishers are supplying the numerator, Anthropic is entitled to discover the denominator."[40] An expert who testifies that an AI-assisted search located the accused routine should expect a request for the searches that found nothing.
The practical answer is to separate locating code from relying on a model's inference. A pointer to a function can be checked. A claim that an undocumented path performs a claimed operation requires the expert's independent analysis. Federal Rule of Evidence 702 requires the proponent to show the court "that it is more likely than not" that the testimony meets each reliability requirement.[45] Preserve the code version, the relevant file identifiers and lines, the tool configuration, and the prompts and outputs the expert considered in forming the opinions, subject to the order and to preservation duties. Do not promise exact replay of stochastic output. Preserve enough to show what the expert examined and how the expert checked it.
Bottom line: log who and when for the producing party, keep what and why with the reviewer, and assume that anything a testifying expert relies on, including the misses, will be discoverable.
VIII. Draft the Permission and Its Limits Together
The following provisions illustrate a protocol for local review. They must be integrated with the case's existing definitions, expert-access rules, source-code printing procedures, and dispute process. The bracketed periods are negotiating choices. Approval of this protocol would not override another provision unless the entered order expressly says so.
A. Specify what is being approved
Proposed language. "Approved Review System" means the hardware, operating system, applications, model files, retrieval components, extensions, permitted commands, storage locations, and export mechanisms identified in the approved configuration schedule. Approval is limited to that configuration and its stated functions. No remote inference, remote embedding service, external connector, or other transmission of Protected Source Material is authorized without further written agreement permitted by this Order or court approval. Material changes to access, execution, retention, or transmission require renewed notice.
"Protected Source Material" means designated Source Code and copies or derivatives that contain, reproduce, encode, or reveal its protected information, including relevant prompts, outputs, indices, embeddings, caches, snapshots, and logs. Such material receives the source-code level of protection pending agreement or resolution of a designation challenge. This treatment does not establish ownership, admissibility, or privilege, and does not extinguish an otherwise applicable protection.
This definition closes the derivative-data gap that White's deletion clause identifies, while preserving a way to distinguish a harmless administrative record from a revealing analysis. It also keeps the producing party's confidentiality designation from becoming a claim to counsel's work product.
B. Give notice that permits a technical evaluation
Proposed language. At least [ten] business days before first use, the Receiving Party shall provide the proposed configuration schedule, an explanation of the intended analytical functions, relevant vendor documentation, and a plan for validation using nonprotected or agreed test material. The proposal shall identify all storage and transmission paths, whether any component can execute commands or change files, and how updates, support access, backups, and deletion will be controlled. It need not disclose counsel's substantive litigation theories.
The Producing Party may object within [five] business days, identifying the disputed feature, the reasonably anticipated harm, and any narrower control that would resolve the objection. The parties shall confer promptly and seek expedited relief if necessary. A timely objection suspends only the disputed new use pending agreement or court decision. Silence permits the proposed use only if this Order expressly establishes that result. This provision does not alter burdens imposed by applicable law.
Corent uses the same architecture for its cloud tools: seven business days' notice identifying the tool's name, version, and operator, five business days to object "with particularity," and no use until the court resolves a timely objection.[1] The party seeking a new capability should provide a reviewable proposal, and the party seeking a restriction should explain it. Neither a vague assurance nor an indefinite veto is a useful procedure.
C. Enforce the review boundary
Proposed language. The Approved Review System shall operate within the specified isolated environment. External network connections, remote administration, telemetry, synchronization, and unapproved removable-media access shall be disabled and tested. Specified communications between approved components on the same machine may occur over loopback interfaces. Any internal connection between separate machines must be expressly listed and authorized.
Produced Source Code shall remain on read-only storage. Permitted analysis writes shall occur only in designated case-specific locations. The system shall deny unapproved commands, arguments, subprocesses, connectors, and privilege escalation through controls independent of the model. Compilation, execution of produced code, package installation, and model-directed software changes require separate express authorization. No Protected Source Material may be used to train, fine-tune, or otherwise modify model parameters or reusable adapters. Approved within-matter retrieval and history are permitted only in the listed storage locations.
Define the machine as well as the restrictions. The configuration schedule should allocate responsibility and cost for hardware, licenses, installation, and technical support, using the proposed workload to size the system. A nominal permission to run a model on inadequate hardware accomplishes little, and R2 teaches that a proposal shifting new burden to the producing party will meet resistance.
D. Regulate exports without disabling litigation use
Proposed language. Protected Source Material may leave the review environment only through the procedures this Order expressly authorizes for excerpts, expert reports, depositions, court submissions, or other approved uses. Machine-generated summaries and diagrams remain subject to protection to the extent they reveal protected information. Classification alone does not authorize export. Requests for excerpts or analytical outputs shall be evaluated for reasonable litigation need, scope, and confidentiality, with prompt judicial resolution of disputes.
Any page or volume limit shall specify whether and how it applies to derived outputs. The protocol shall permit requests for reasonable additional material and shall not make model output an unrestricted substitute for copying the source repository. No reviewing party is required to submit privileged legal analysis to its adversary for substantive approval as a condition of export; disputed confidentiality or volume issues shall use a redacted submission or neutral review where necessary.
Automatic page-for-page equivalence between a summary and a code printout is a poor default. One page can disclose an important algorithm; several pages may contain little useful information. The provision should control what is revealed while preserving the ability to prepare the papers the case requires.
E. Protect audit records and respond to incidents
Proposed language. The parties shall specify the security events to be recorded, their retention periods, access controls, and measures against alteration. Routine compliance reports shall omit substantive prompts, outputs, search terms, file selections, and command arguments except to the extent necessary to report a concrete incident. Detailed records shall be held within the protected environment or by an agreed neutral and shall not be available for routine inspection by the Producing Party.
On a particularized showing of suspected noncompliance, the parties shall confer regarding a targeted examination. Absent agreement, the Court shall determine access, including privilege review, appropriate redactions, and neutral or in camera inspection. These procedures preserve, but do not create, privilege and work-product protection and do not displace required expert disclosures.
Upon discovering a suspected unauthorized transmission, access, or material change, the affected party shall stop the implicated operation, preserve relevant evidence, and notify the other party promptly and no later than [one] business day, with supplemental information as reasonably available. Notification shall provide the facts necessary to investigate and mitigate the event without conceding a waiver or requiring unnecessary disclosure of protected strategy.
F. Make clawback work throughout the system
Proposed language. Upon notice of a claim of privilege or work-product protection, the Receiving Party shall comply with Rule 26(b)(5)(B) and any applicable Rule 502(d) order. Pending resolution, the Receiving Party shall cease use of the identified material and sequester it, together with reasonably identifiable copies and derived content that reproduce or reveal it. The party shall prevent retrieval of that material, rebuild affected indices where necessary, and address cached context, histories, and exports. If a disputed record also contains claimed work product, it shall be isolated for appropriate review and not disclosed wholesale to the Producing Party.
Rule 26(b)(5)(B) already requires a party that receives notice to "promptly return, sequester, or destroy the specified information and any copies it has," and forbids use or disclosure until the claim is resolved. A Rule 502(d) order can protect against waiver in the circumstances it covers.[46][47] Neither provision makes a system forget anything. The protocol must make legal compliance technically possible across every relevant store.
The no-training restriction pays for itself here. Removing a document from an index is a defined task. Removing its influence from modified model parameters is not. Do not promise deletion the system cannot verify.
G. Reconcile preservation with final disposal
Proposed language. Return or destruction shall occur after final disposition, including appeals, within the period this Order specifies, subject to any continuing preservation duty or court directive. Before disposal, the parties shall resolve any pending need to preserve records for a compliance dispute or review of expert testimony. The designated operator shall inventory and sanitize case-specific copies across analysis storage, histories, checkpoints, caches, backups, and export locations, using a method appropriate to the medium and sensitivity.
Authorized archival copies shall remain restricted and shall not be used for unrelated matters, product development, or model training. Counsel's archival rights shall not authorize retention of a reusable source-code index or full review environment unless expressly provided. The responsible parties shall certify the actions taken and identify any authorized exceptions. An unchanged hash of model weights does not substitute for this certification. The Producing Party's original business repositories are outside this disposal obligation.
NIST Special Publication 800-88 Revision 2 supplies technical guidance for media sanitization.[48] The method should fit the medium; deleting visible files does not sanitize anything. Preservation must be resolved before destruction, including any obligation concerning electronically stored information under Rule 37(e).[49]
IX. Build the Record a Court Can Decide
The best motion begins with the existing order and the exact change requested. It then gives the judge a short declaration from someone who can explain and test the proposed system, a configuration schedule, a data-flow diagram, and a demonstration on nonprotected material. It identifies what remains uncertain and how the proposed controls address it. Table 6 lists the package.
Table 6. The evidence package for an AI review motion
Exhibit | What it proves | Sponsor |
Operative order and a redline of the requested change | The procedural posture and the exact relief sought | Counsel |
Configuration schedule | Every component, version, setting, storage location, and export path | Technical declarant |
Data-flow diagram | That no protected material reaches a remote service, including embeddings, telemetry, updates, and support access | Technical declarant |
Network and permission test results | Isolation, loopback-only communication, read-only source, and denied commands | Technical declarant or neutral |
Demonstration on nonprotected code | What the tool does on a representative task and how its outputs are verified | Expert |
Time and cost comparison | The proportionality burden, quantified | Expert and counsel |
Retention inventory and disposal plan | Every store the system writes and how each is sequestered, clawed back, and sanitized | Technical declarant |
Pilot proposal | Scope, tasks, stop condition, and criteria for expansion | Counsel |
Show the analytical benefit with a representative task. Explain whether the tool helps locate candidate functions, follow references across a large codebase, identify missing dependencies, or test a specific hypothesis. Then put a number on it. In Jeffries, the plaintiffs argued that AI restrictions would raise their costs, and the court found no undue burden because they "have not presented any support for the increased burden, such as by attempting to quantify the extent of any such increased cost."[11] The amended order did not survive the case's later changes, but expect to see that sentence quoted against any receiving party that complains about cost without a number. Estimate review time and expense from an actual demonstration and disclose the assumptions. A vendor's general productivity claim is not evidence about this repository.
Answer the vendor-chain question before the court asks it. MFB Fertility turned on a proponent whose papers did not make clear which models sat behind the tool or what their retention terms were.[3] For a local system, the answer should be short and verifiable: no remote model, no remote embedding service, no telemetry, and a network test that proves it.
The producing party's own AI use may justify focused questions about a claimed technical limitation. It does not create consent to an adversary's use, eliminate a confidentiality interest, or establish that the two environments have equivalent safeguards. Compare permissions, custody, support access, and retention before arguing inconsistency. Reciprocity is useful when it applies equivalent protections to equivalent information. It does not require identical rules for public documents and highly sensitive code. Nor should confidentiality negotiations silently expand the permitted use of code into another case or a patent-office proceeding. If that use is necessary, address it expressly.
A small, supervised pilot can resolve what competing declarations cannot. The order can authorize a limited configuration and defined tasks, preserve the relevant records, specify a stop condition, and permit expansion after a successful evaluation. MultiPlan's reservation of a later, record-based request after inspection points the same way.[21] A pilot is evidence about the tested setup, not proof that every future feature is safe.
The central litigation interest is the ability to test the accused implementation against the asserted claims. Counsel should insist on tools sufficient to do that work and accept the controls that can be justified. A producing party should have to explain why a proposed safeguard fails, and a receiving party should have to show that the safeguard actually exists. That is a record a court can decide.
Disclosure: I build AI tools for my firm and use several of the products discussed here. Product documentation describes available capabilities; it does not certify a particular deployment or authorize use under a protective order. Nothing in this article is legal advice for any specific matter.
Authorities and technical sources
Court records, statutes, procedural and evidentiary rules, government guidance, and original product documentation, cited in Bluebook form and numbered in order of first citation. Each citation links to the cited document. Technical documentation was accessed October 25, 2026.
[1] Corent Tech., Inc. v. Amazon Web Servs., Inc., No. 8:26-cv-00194-JVS-DFM, 2026 WL 2924482, §§ 4.3.2, 4.3.6, 12–12.7.2 & n.1, at 5–6, 13–17 (C.D. Cal. Sept. 28, 2026) (stipulated protective order). Signed by Magistrate Judge Douglas F. McCormick; also available as ECF No. 53. Footnote 1 records that Amazon agreed to the AI provisions for that matter only.
[2] Install & Run Understand Fully Offline, SciTools, https://docs.scitools.com/help/air-gapped/install-offline.html (last visited Oct. 25, 2026); Local AI with No Cloud Calls, SciTools, https://docs.scitools.com/help/air-gapped/local-ai-no-cloud.html (last visited Oct. 25, 2026). Vendor documentation describing offline installation, optional network features, and local or hosted AI configurations.
[3] MFB Fertility, Inc. v. Action Care Mobile Veterinary Clinic, LLC, No. 1:23-cv-03854, ECF No. 133, at 2–8 & n.5 (N.D. Ill. Sept. 9, 2026) (order). Magistrate Judge Gabriel A. Fuentes. Footnote 5 collects AI protective-order provisions from other districts.
[4] White v. Chime Fin. Inc., No. 2:25-cv-01361-KKE, ECF No. 61, § 12, at 15 (W.D. Wash. Oct. 6, 2026) (stipulated protective order). The filed order's caption is White; the CourtListener docket index lists the consolidated action as Charles v. Chime Financial Inc.
[5] Cobblestone Wireless, LLC v. Apple Inc., No. 7:24-cv-00232-ADA, ECF No. 52, ¶ 39, at 24 (W.D. Tex. Jan. 28, 2026) (stipulated supplemental protective order between nonparty Qualcomm Incorporated, plaintiff, and defendant). Signed by Judge Alan D. Albright. Governs material produced by nonparty Qualcomm.
[6] Wilus Inst. of Standards & Tech., Inc. v. HP Inc., No. 2:24-cv-00752-JRG-RSP, ECF No. 196, ¶ 34, at 26–27 (E.D. Tex. Dec. 2, 2025) (supplemental Broadcom protective order). Signed by Judge Rodney Gilstrap. Governs material produced by nonparty Broadcom.
[7] 5000 Plus LLC v. Majestic Steel USA, Inc., No. 2:26-cv-01041-APG-MDC, 2026 WL 1831063, § 13, at *7 (D. Nev. June 24, 2026) (stipulated protective order). Also available as ECF No. 20.
[8] In re Terra Int'l, Inc., 134 F.3d 302, 306–07 (5th Cir. 1998) (per curiam). The analysis concerns an order sequestering deposition witnesses.
[9] Philips N. Am. LLC v. Global Med. Imaging, LLC, 343 F.R.D. 59, 66–67 (N.D. Ill. 2022). Magistrate Judge Sheila M. Finnegan. Also available as ECF No. 111.
[10] R2 Solutions LLC v. Databricks, Inc., No. 4:23-CV-1147, 2024 WL 4753314, at *1–2 (E.D. Tex. Nov. 12, 2024). Judge Amos L. Mazzant III. Also available as ECF No. 60.
[11] Jeffries v. Harcros Chems. Inc., No. 2:25-cv-02352-KHV-ADM, ECF No. 111 (D. Kan. Dec. 19, 2025) (text order); id., ECF No. 152, at 2–8 (D. Kan. Mar. 25, 2026) (mem. & order); id., ECF No. 196 (D. Kan. June 11, 2026) (text order); id., ECF No. 203 (D. Kan. July 16, 2026) (text order). Magistrate Judge Angel D. Mitchell entered ECF Nos. 152 and 203; District Judge Kathryn H. Vratil entered ECF No. 196. ECF No. 203 vacated the Amended Protective Order (ECF No. 153) on joint request and reinstated ECF No. 115. The caption spells the plaintiff's surname Jeffries; the CourtListener index uses Jefferies.
[12] MasterObjects, Inc. v. Amazon.com, Inc., No. 1:20-cv-03478-PKC, ECF No. 59, ¶ 8, at 24 (S.D.N.Y. July 29, 2020) (stipulated protective order, remote-review provisions).
[13] 18 U.S.C. § 1839(3). Federal definition of a trade secret.
[14] Fed. R. Civ. P. 26(b)(1), (c)(1)(G). Proportionality and protection of confidential commercial information.
[16] In re Deutsche Bank Trust Co. Americas, 605 F.3d 1373, 1378, 1381 (Fed. Cir. 2010) (quoting FTC v. Exxon Corp., 636 F.2d 1336, 1350 (D.C. Cir. 1980)). Prosecution-bar framework, used here by analogy.
[18] MBA Eng'g Inc. v. Matrix Trust Co., No. 3:20-CV-01915-E, 2023 WL 2619172, at 4 (N.D. Tex. Mar. 23, 2023) (quoting In re DePuy Orthopaedics, Inc. Pinnacle Hip Implant Prods. Liab. Litig., No. 3:11-MD-2244-K, 2016 WL 10719394, at 3 (N.D. Tex. July 8, 2016) (citing Raytheon Co. v. Indigo Sys. Corp., No. 4:07-CV-109, 2008 WL 4371679, at *2–3 (E.D. Tex. Sept. 18, 2008))). Judge Ada Brown. Also available as ECF No. 128, at 7–8.
[19] STT WebOS, Inc. v. ByteDance Ltd., No. 5:26-cv-01456-BLF (SVK), ECF No. 141, at 1–2 (N.D. Cal. July 24, 2026) (order re governing protective order). Magistrate Judge Susan van Keulen.
[20] STT WebOS, Inc. v. ByteDance Ltd., No. 5:26-cv-01456-BLF, ECF No. 145, § 14.5, at 20–21 (N.D. Cal. Aug. 4, 2026) (protective order).
[21] In re MultiPlan Health Ins. Provider Litig., No. 1:24-cv-06795, MDL No. 3121, ECF No. 757, ¶¶ 1, 5(i), 7, at 1, 14 (N.D. Ill. June 26, 2026) (Case Management Order No. 35 (Source Code Protective Order)). Judge Matthew F. Kennelly.
[22] Morgan v. V2X, Inc., No. 1:25-cv-01991-SKC-MDB, 2026 WL 864223, at 1, 4–7, 6 n.2, 7 nn.4–5 (D. Colo. Mar. 30, 2026). Magistrate Judge Maritza Dominguez Braswell. Distinction of Heppner at 4; tool-identity analysis at 5; operative AI provision at *7. Also available as ECF No. 65.
[23] N.D. Cal. Patent L.R. 2-2; Model Protective Order for Litigation Involving Patents, Highly Sensitive Confidential Information and/or Trade Secrets § 9, at 13–14 (N.D. Cal.) (optional source-code provisions), https://cand.uscourts.gov/sites/default/files/documents/ND_Cal_Patent_Highly_Sensitive_Model_Prot_Ord_Revised.pdf; see also Model Protective Orders, U.S. Dist. Ct. for the N. Dist. of Cal., https://cand.uscourts.gov/rules-forms-fees/northern-district-guidelines/model-protective-orders (last visited Oct. 25, 2026).
[24] In re Agilon Health, Inc. Sec. Litig., No. 1:24-cv-00297-DAE, ECF No. 87, at 1 (W.D. Tex. Jan. 6, 2026) (joint motion for entry of confidentiality and protective order); id., ECF No. 89, § 4, at 6 (W.D. Tex. Jan. 7, 2026) (confidentiality and protective order). Magistrate Judge Susan Hightower. The joint motion set out competing proposals for section 4; the order adopts the plaintiffs' language without a written explanation.
[25] Certain Integrated Circuits, Elec. Devices Containing the Same, & Components Thereof, Inv. No. 337-TA-1450, Order No. 24, 2025 WL 3786669, ¶ 22.C(iv), at *4 (Int'l Trade Comm'n Dec. 29, 2025). Administrative Law Judge Monica Bhattacharyya. The order grants a joint motion by the complainant and third party OPPO; the respondent OnePlus and the Commission Investigative Staff supported it, and the other respondents took no position.
[26] Daedalus Prime LLC v. Google LLC, No. 7:25-cv-00313-DC-DTG, ECF No. 95, ¶ 16, at 15–16 (W.D. Tex. Sept. 30, 2026) (stipulated third amended protective order). Signed by Magistrate Judge Derek T. Gilliland. The same provision appears in the original protective order, ECF No. 71 (Apr. 29, 2026), and the second amended order, ECF No. 88 (Aug. 12, 2026).
[27] Daedalus Prime LLC v. Marvell Tech., Inc., No. 1:26-cv-00081-ADA, ECF No. 43, ¶ 32, at 18–19 (W.D. Tex. May 11, 2026) (stipulated protective order). Signed by Judge Alan D. Albright.
[28] Network Sys. Techs., LLC v. Marvell Semiconductor, Inc., No. 1:25-cv-01649-ADA, ECF No. 40, § 14.10 & nn.9–10, at 24–25 (W.D. Tex. June 1, 2026) (protective order). Signed by Judge Alan D. Albright on the parties' stipulation. Footnote 9 repeats the public-service floor of Doe v. Google; footnote 10 excludes usage and log data that do not reveal protected content.
[29] Array Cache Techs., LLC v. MediaTek Inc., No. 2:25-cv-00669-JRG-RSP, ECF No. 45, ¶ 22, at 13–14 (E.D. Tex. June 26, 2026) (protective order). Signed by Magistrate Judge Roy S. Payne on the parties' stipulation. Paragraph 22 preserves the order's separate source-code provisions in paragraph 10.
[30] Glean IP Holdings Inc. v. Glean Techs., Inc., No. 3:25-cv-08536-RFL-AGT, ECF No. 84, § 14, at 17 (N.D. Cal. July 10, 2026) (stipulation and protective order). So ordered by Magistrate Judge Alex G. Tse.
[31] Velez v. One Plus Tech. (Shenzhen) Co., No. 1:25-cv-02432-RA-HJR, ECF No. 28, § 10(A)–(C), at 4–5 (S.D.N.Y. June 16, 2026) (stipulated confidentiality and protective order). So ordered by Magistrate Judge Henry J. Ricardo. Page numbers are to the ECF header.
[32] Doe I v. Google LLC, No. 3:23-cv-02431-VC, ECF No. 329, § 14.10 & n.11, at 23 (N.D. Cal. Sept. 1, 2026) (stipulated protective order re discovery of source code). Entered as modified by the court.
[33] FAQ, Ollama, https://docs.ollama.com/faq (last visited Oct. 25, 2026). See "How do I disable Ollama's cloud features?" and "How can I expose Ollama on my network?"
[34] Local Models (Ollama), Cline, https://docs.cline.bot/running-models-locally/ollama (last visited Oct. 25, 2026).
[35] Nat'l Inst. of Standards & Tech., NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations §§ 3.1.1, 3.4, 3.5, at 38–39, 50–54 (Mar. 2025), https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf.
[36] Checkpoints, Cline, https://docs.cline.bot/core-workflows/checkpoints (last visited Oct. 25, 2026). See "How It Works" and "Enable or Disable Checkpoints."
[37] Auto Approve & YOLO Mode, Cline, https://docs.cline.bot/features/auto-approve (last visited Oct. 25, 2026). See "Safe vs Approval-Required Commands."
[38] Sporck v. Peil, 759 F.2d 312, 315–16 (3d Cir. 1985). Judge Collins J. Seitz dissented.
[39] Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629, 636–37 (E.D. Mich. 2026). Magistrate Judge Anthony P. Patti. A later order granting summary judgment (ECF No. 124, Oct. 19, 2026) does not address the AI ruling.
[40] Concord Music Group, Inc. v. Anthropic PBC, No. 5:24-cv-03811-EKL (SVK), 2025 WL 3677935, at 3–5 (N.D. Cal. Dec. 18, 2025) (quoting ECF No. 377, at 3 (N.D. Cal. May 23, 2025) (quoting Tremblay v. OpenAI, Inc., No. 23-cv-03223-AMO, 2024 WL 3748003, at 2–3 (N.D. Cal. Aug. 8, 2024)), and ECF No. 478, at 4–5 (N.D. Cal. Oct. 12, 2025)). Magistrate Judge Susan van Keulen; also available as ECF No. 545. "Queries crafted by counsel" is Tremblay's phrase; "at best[] fact work-product" comes from the court's own October 2025 order. Anthropic's motion for relief from ECF Nos. 478 and 545 was denied as moot on stipulation, ECF No. 722 (May 27, 2026), after the publishers dismissed their secondary-liability claims.
[41] United States v. Heppner, 820 F. Supp. 3d 292, 294–99 (S.D.N.Y. 2026). Judge Jed S. Rakoff; criminal case. KeyCite flags the decision as disagreed with by Assini v. Hayward, a New York trial-court decision.
[42] Assini v. Hayward, 261 N.Y.S.3d 915, 919–20 (Sup. Ct. 2026). Justice Rhonda E. Fischer, Supreme Court, Nassau County; also reported at 2026 N.Y. Slip Op. 26086.
[43] In re Agilon Health, Inc. Sec. Litig., No. 1:24-cv-00297-DAE, ECF No. 122, at 1 (W.D. Tex. Apr. 24, 2026) (plaintiffs' opposed motion to compel disclosure on the use of generative artificial intelligence); id., ECF No. 123, at 6–7 (W.D. Tex. May 1, 2026) (agilon defendants' response in opposition); id., ECF No. 141, ¶ 7, at 3 (W.D. Tex. June 12, 2026) (order). Magistrate Judge Susan Hightower. The order denies the motion "[f]or the reasons stated from the bench" at the June 3, 2026 hearing; no written analysis was filed.
[44] Fed. R. Civ. P. 26(a)(2)(B), (b)(3), (b)(4)(A)–(D). Expert disclosures, work product, drafts, and attorney-expert communications.
[45] Fed. R. Evid. 702. As amended Dec. 1, 2023.
[46] Fed. R. Civ. P. 26(b)(5)(B). Clawback procedure.
[47] Fed. R. Evid. 502(d)–(e). Court-ordered nonwaiver protection and the limited effect of party agreements.
[48] Nat'l Inst. of Standards & Tech., NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (Sept. 26, 2025), https://csrc.nist.gov/pubs/sp/800/88/r2/final.
[49] Fed. R. Civ. P. 37(e). Loss of electronically stored information that should have been preserved.
Comments