Setting the chapter. One moment.
Skills
Chapter 4 of 5
Shared building blocks for Box-based legal workflows — Box collaboration role definitions, Box AI usage boundaries (what AI must not decide), and reusable human-in-the-loop…
2 minutes · 425 words · 12 sections
PREREQUISITE: Read
box:boxfor Box MCP authentication, tool selection, and base workflows. If missing, run:npx skills add https://github.com/box/box-for-ai --skill box
Shared building blocks used by the legal skills (M&A, Intake, Contract Review): Box collaboration role definitions, the boundaries of where Box AI must not be the decision-maker, and reusable confirmation phrasings. Risk frameworks, metadata fields, workflows, and decision-transparency requirements live in the individual legal skills.
Reach for these for the underlying Box tool mechanics rather than restating them here:
box:references/collaboration.md — collaborator role capabilities, shared links, and external-sharing rulesbox:references/ai-and-retrieval.md — Box AI Q&A, extraction, and structured metadata tools, with pacing/limits/citations[CONFIRM: What permission level is appropriate?]
For the full breakdown of each Box collaborator role (Co-owner, Editor, Viewer Uploader, Previewer Uploader, Viewer, Previewer, Uploader) and the exact capabilities each grants, see the role matrix in box:references/collaboration.md. Use that matrix to determine which role fits a given collaborator, then have the human confirm the choice before granting access.
Apply least privilege: default to the most restrictive role that still lets the collaborator do their job, prefer specific folders over root access, and set expiration dates on external collaborations.
Box AI informs; a human attorney decides. Do NOT use Box AI for:
Box AI is appropriate for informing humans — completeness checks, risk-factor flagging, metadata extraction, contract comparison, and due-diligence Q&A — always with citations surfaced and a human making the final call.
For details on the Box AI tools available and how to use them, see box:references/ai-and-retrieval.md.
Reusable phrasings for the human-in-the-loop confirmations the legal skills require.
“Here are the factors I found: […], with citations from Box. Under your firm’s criteria, which rating applies?” (The agent presents facts; the firm’s criteria and attorney determine the rating.)
“I’ll grant [person] [role] access to [folder/file]. They can [permissions]. Proceed?”
“Based on [practice area/risk/type], I recommend routing to [attorney]. Correct, or assign to someone else?”
“Firm requires: [list]. Found: [list]. Missing: [list]. Proceed with assessment?”
“Do you have a Box metadata template for [type]? If yes, scope and template key?”
“What is your firm’s threshold for [matter value/expiration alert/risk escalation]?”
“Before sharing with [external party], confirm: (1) Permission level? (2) Folders? (3) Expiration? (4) Link or collaboration?”
Install this repository
npx skills add box/box-for-ai/plugin marketplace add box/box-for-aiSkills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.
Shared building blocks for Box-based legal workflows — Box collaboration role definitions, Box AI usage boundaries (what AI must not decide), and reusable human-in-the-loop confirmation phrasings. Referenced by box-legal-workflows-ma, box-legal-workflows-intake, and box-legal-workflows-contract skills.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
main, last pushed 7 August 2026.SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.h1 and no skipped levels:.claude-plugin/marketplace.json by Box, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree./box/box-for-ai.md, and each chapter at its own .md URL.