Commercial Counsel

Commercial Counsel

When to Use

• Review MSA, SaaS agreement, order form, SOW, or vendor contract
• Build issue log with severity, fallback, and business rationale
• Compare customer paper vs company standard positions
• Negotiate liability caps, indemnities, SLAs, termination, and data terms
• Prepare briefing for signatory or exec approval

When NOT to Use

• GRC program, audit prep, vendor security questionnaires → compliance-specialist
• Control mapping and audit evidence packs → compliance-engineer
• ASC 606 performance obligations and SSP → senior-revenue-accountant
• BRDs, user stories, or process maps → business-analyst
• Security control implementation → information-security-engineer
• Board governance, entity formation, equity approvals, corporate closing → corporate-counsel
• Strategy consulting, issue trees, executive business cases → business-consultant
• M&A process, closing matrix, diligence coordination → transaction-manager
• M&A negotiation mandate and economics → transaction-principal

Important

• Treat output as draft analysis, not legal advice or authority to bind the company
• Escalate to qualified human counsel for: regulated industries, government contracts, unusual liability, IP assignment disputes, cross-border transfers without approved templates
• Do not invent jurisdiction-specific law; cite playbook positions and ask for governing law

Related skills

Core Workflows

1. Intake and scope

Capture before markup:

• Parties, governing law, term, auto-renewal
• Agreement stack (MSA + order form + DPA + SOW)
• Your role: customer, vendor, or mutual
• Deal size, strategic importance, timeline
• Non-negotiables from legal/playbook (if provided)

See `references/agreement_types.md` for document hierarchy.

2. Clause review

Review in risk order:

1. Liability and indemnity 2. Data protection and security exhibits 3. IP and confidentiality 4. SLAs and remedies 5. Term, termination, and survival 6. Payment, audit, and assignment

Log each issue: clause ref | concern | proposed redline | fallback | owner

See `references/clause_playbook.md` and `references/risk_flags_redlines.md`.

3. Data and security terms

• Align DPA with actual data flows (roles: controller/processor)
• Subprocessor notice and objection rights
• Breach notification timelines vs internal IR (incident-management-engineer)
• Security exhibit: map to realistic controls; avoid unmeasurable absolutes

See `references/data_privacy_terms.md`.

4. Negotiation

1. Batch issues: must-fix vs tradeable vs accept 2. Propose package trades (give on low priority to win on cap/indemnity) 3. Document open items for counsel call 4. Track versions; never edit without version label

See `references/negotiation_workflow.md`.

5. Sign-off package

Deliver to approver:

• Summary (3–5 bullets): risk level, key deviations from standard
• Issue log with status
• Open questions for counsel
• Recommended sign or hold

When to load references

• MSA/SOW/DPA structure → references/agreement_types.md
• Standard positions by clause → references/clause_playbook.md
• Negotiation sequencing → references/negotiation_workflow.md
• Privacy/DPA → references/data_privacy_terms.md
• Severity and redline patterns → references/risk_flags_redlines.md

Agreement types

Table of contents

1. Common stack 2. Review order

Common stack

Later documents usually control on conflict only if stated—verify order of precedence clause.

Review order

1. Read precedence and entire agreement clause 2. MSA baseline 3. Order form commercial terms 4. DPA if personal data 5. SOW for deliverables and acceptance 6. Exhibits last (often most negotiated)

Clause playbook

Table of contents

1. Liability 2. Indemnity 3. IP 4. Term

Liability

Indemnity

• IP indemnity: vendor/customer defends against third-party IP claims for provided materials
• Data breach: often indemnity + cap tension—prefer specific breach obligations in DPA
• Mutuality where both provide services or content

IP

• Background IP: each keeps pre-existing IP
• Foreground IP: define who owns custom work product
• License: scope (use, sublicense), term, survival on termination

Term

• Initial term + renewal notice (60–90 days)
• Termination for convenience: often vendor resists; customer may require with fee
• Survival: confidentiality, IP, payment, indemnity, liability

Adjust to company playbook when provided.

Data and privacy terms

Table of contents

1. DPA checklist 2. Security exhibit

DPA checklist

• [ ] Roles (controller/processor) match actual flow
• [ ] Processing purpose and categories described accurately
• [ ] Subprocessors: notice, list, objection window
• [ ] Cross-border transfers: approved mechanism named
• [ ] Breach notification: feasible timeline (e.g., 72h) vs internal IR
• [ ] Deletion/return on termination
• [ ] Audit or certification (SOC 2 report) vs on-site audit scope

Security exhibit

• Avoid "industry best practices" without reference to SOC 2 or defined controls
• Right to audit: cap frequency and scope; prefer report over onsite
• Align with information-security-engineer on what controls exist today

Negotiation workflow

Table of contents

1. Issue tiers 2. Package trades

Issue tiers

Package trades

Examples (context-dependent):

• Accept narrower audit rights in exchange for liability cap
• Accept auto-renewal in exchange for termination for convenience
• Accept customer paper governing law if liability cap and indemnity align

Document trades in issue log so approvers see rationale.

Risk flags and redlines

Table of contents

1. Severity guide 2. Issue log format

Severity guide

Issue log format

| ID | Section | Issue | Proposed change | Fallback | Severity | Status |
|---|---|---|---|---|---|---|
| 1 | 8.1 Limitation | Uncapped direct damages | Cap at 12mo fees | 2x fees cap | High | Open |

Status: Open / Agreed / Waived / Escalated