How to Set Up Claude Opus 5 and GitHub Copilot for Legal Workflows

The Q3 2026 setup problem is not whether Claude Opus 5 is good enough for legal work. It is where the model can actually be used. Opus 5 is available through Anthropic’s API as of July 24, 2026, with thinking enabled by default, effort controls from low to max, and self-verification behavior aimed at catching flawed outputs before they leave the model loop.[1] GitHub Copilot’s supported-models table, however, still lists Claude Opus 4.8 as the latest Opus model available in Copilot, not Opus 5.[2]

That gap matters for legal workflows because the highest-risk work is rarely the same work that benefits most from living inside the IDE. A senior associate does not need Opus 5 to generate a repository wrapper for a document assembly pipeline. A litigation team may want Opus 5 when the task is comparing privilege descriptions across custodians, preparing deposition outlines from a dense record, or analyzing contract language under a specific jurisdiction. The safe architecture is therefore split: use Opus 4.8 inside GitHub Copilot for embedded engineering work, and route selected legal reasoning tasks to Opus 5 through the API. Then enforce one verification layer across both paths.

The Working Architecture

The architecture should start with routing, not model enthusiasm. Copilot with Opus 4.8 belongs close to repositories, document templates, YAML workflows, test fixtures, citation parsers, clause extraction scripts, and MCP-connected tools. Opus 5 belongs behind an API boundary where the request can be logged, scoped, priced, approved, and evaluated before anyone relies on the result in a client-facing document.

GitHub’s customization layer is the reason this split can be governed without asking every lawyer, engineer, and agent to remember a policy. GitHub documents repository-wide custom instructions in .github/copilot-instructions.md, path-specific .instructions.md files, CLAUDE.md instructions, hooks in .github/hooks/*.json, custom agents, skills, and MCP servers as part of Copilot customization.[3] Those controls are model-agnostic. A hook that blocks a generated brief because it contains an uncited case name does not care whether the text came from Opus 4.8, Opus 5, Sonnet 5, or the next model GitHub adds to the picker.

Why Opus 4.8 Still Has a Serious Job Inside Copilot

The availability gap should not be read as a reason to avoid Copilot. Opus 4.8 is already a strong fit for embedded legal engineering work. Anthropic says Opus 4.8 achieved the highest recorded score on Thomson Reuters CoCounsel Legal’s internal legal-agent benchmark, and says it is around four times less likely than its predecessor to let flaws in code it wrote pass unremarked.[4] That is vendor-disclosed evidence, not independent validation, but it is directly relevant to the work Copilot is best positioned to do: write code, critique generated code, conform to repository patterns, and operate within project instructions.

The useful Copilot setup is not “let the associate chat with the model.” It is a repository where Copilot suggestions are boxed in by matter-aware instructions, testable fixtures, and tool access that has already been approved. A document automation repo can tell Copilot where templates live, which citation parser is authoritative, which fields must never be inferred, and which directories contain privileged or client-confidential examples.

# Legal workflow instructions

This repository supports legal document automation. Treat generated content as draft work product only.

Required behavior:
- Do not invent case citations, docket numbers, quotations, statute sections, filing dates, party names, or court names.
- If a requested citation is not present in an approved source file or MCP retrieval result, write: "SOURCE NOT FOUND".
- Preserve privilege labels and confidentiality markings exactly as provided.
- Do not move client material into logs, examples, test snapshots, or generated documentation.
- For filing-facing output, create a verification checklist instead of finalizing the filing text.

Approved sources:
- /authorities/verified/
- /matters/{matter_id}/source-record/
- MCP tools explicitly configured for this repository

Blocked behavior:
- No public web substitution for missing authority.
- No citation cleanup based on model memory.
- No jurisdiction transfer unless the target jurisdiction is stated in the task.

That kind of instruction belongs in .github/copilot-instructions.md. It is deliberately boring. The value is not prose elegance; the value is that every Copilot interaction in the repository starts from the same floor.

Where Opus 5 Earns the API Call

Opus 5 should be reserved for tasks where reasoning quality changes the legal risk profile enough to justify the extra routing. Anthropic’s Opus 5 documentation describes thinking as on by default, effort control from low to max, and improved self-verification.[1] In a legal workflow, those features are most valuable when the model is asked to reason over competing interpretations, not when it is asked to generate boilerplate.

• Use Opus 5 for jurisdiction-specific contract analysis when the answer depends on governing law, enforceability, remedies, or defined-term interactions across a long agreement.
• Use Opus 5 for privilege log review when the model must compare descriptions, roles, dates, recipients, and privilege theories without flattening exceptions.
• Use Opus 5 for deposition preparation when the work requires linking testimony goals to exhibits, admissions, impeachment material, and disputed facts.
• Keep Opus 4.8 in Copilot for generating schema changes, test harnesses, extraction code, prompt wrappers, and document assembly logic.

The API boundary also makes cost visible. Anthropic’s legal summarization guide estimates that summarizing 1,000 sublease agreements would cost $438.75 using Opus 5 at $5 per million input tokens and $25 per million output tokens, compared with $87.75 using Haiku 4.5.[5] That does not prove Opus 5 is too expensive; it proves the routing decision should be explicit. A privilege review that changes production strategy may justify Opus 5. Routine first-pass summarization may not.

The same guide notes a 512-token prompt cache minimum for Opus 5, down from 1,024 on Opus 4.8.[5] That is not a headline feature, but it matters in recurring legal workflows. Clause review, privilege screening, deposition issue spotting, and contract playbook checks often reuse stable instruction blocks. A lower cache threshold makes it easier to benefit from caching when the prompt pattern repeats across many documents.

Sonnet 5 can sit between those paths when budget pressure is real and the task is closer to legal engineering than legal judgment. Anthropic platform materials list introductory Sonnet 5 pricing at $2 per million input tokens and $10 per million output tokens through August 31, 2026. Because that pricing window is temporary, teams should verify current pricing before encoding it into matter budgets. The architectural point is simpler than the price table: do not spend Opus 5 calls on work that can be constrained, tested, and reviewed inside Copilot.

The Verification Gate Is the Product

The verification layer is where this setup either survives real legal practice or becomes another demo. Court sanctions for AI-generated legal errors tend to follow recognizable patterns: fabricated citations, misquoted authorities, jurisdiction drift, and failure to supervise model-drafted text before filing. The gate layer should be built around those failure modes, not around abstract “AI safety” language.

A workable gate has four parts. Repository instructions establish default behavior. Path-specific instructions change the rules for sensitive directories. CLAUDE.md tells agentic workflows how to behave when they plan, call tools, or modify files. Hooks run deterministic checks at lifecycle points so the final decision is not left entirely to the model.

The path-specific layer matters because legal repositories are not homogeneous. The same model behavior that is acceptable in a template utilities folder may be unacceptable in a privilege log directory. A /privilege-logs/.instructions.md file can require preservation of sender, recipient, date, privilege type, redaction status, and source row identifiers. A /briefs/.instructions.md file can require every cited authority to map to an approved source file before draft text leaves the repository. A /contracts/.instructions.md file can forbid cross-jurisdiction generalization unless the target law is specified by the user or matter metadata.

# /briefs instructions

Before suggesting filing-facing text:
- Verify every case citation against /authorities/verified/ or an approved MCP result.
- Quote only from source text present in the repository or approved retrieval result.
- Flag any proposition that lacks jurisdiction-specific support.
- Add "ATTORNEY REVIEW REQUIRED" to any generated argument section.

Never:
- Substitute a similar case from memory.
- Normalize a citation unless the source citation is present.
- Draft a signature block, certificate, or filing representation as final.

Hooks should be less polite. They should fail builds, block pull requests, or require human review when they detect patterns that have produced sanctions in the court record. A hook can scan for citation-looking strings and require a match in an approved authority index. Another can block generated privilege logs if required metadata columns are missing. A third can flag any filing-facing document that contains “SOURCE NOT FOUND,” “verify,” or unresolved bracketed placeholders.

{
  "name": "legal-citation-gate",
  "lifecycle": "pre-submit",
  "command": "python tools/verify_citations.py --input ${changed_files} --authority-index authorities/verified/index.json",
  "on_failure": "block",
  "message": "Citation verification failed. Filing-facing legal text cannot proceed until every cited authority maps to an approved source."
}

That example is intentionally deterministic. The model may help draft the argument, but it should not be the final judge of whether a cited case exists, whether a quotation matches the source, or whether a privilege label survived a transformation. In legal automation, the last mile belongs to reproducible checks and accountable review.

Privilege Controls Cannot Be an Afterthought

Privilege handling is where model choice and product tier stop being procurement details. Fable 5 is available in GitHub Copilot, according to GitHub’s June 9, 2026 changelog, but the research constraint that matters for legal work is its 30-day data retention condition.[6] For privileged workflows, that condition is enough to remove it from the default path. A model being available in Copilot does not make it suitable for client-confidential material.

The practical rule is blunt: privileged matter data should move only through enterprise-grade configurations with retention, logging, and access terms that the firm or legal department has approved. If a workflow cannot prove where privileged material travels, what is logged, who can retrieve it, and how long it remains accessible, it should not receive privileged material. That applies equally to Copilot prompts, API payloads, MCP retrievals, test fixtures, and agent logs.

A common failure mode is to protect the model call while leaking the same material into the surrounding tooling. An engineer uses approved API credentials, then stores prompt-response pairs in a debugging table. A template generator strips names from the document but leaves matter IDs in snapshot tests. An agent is prevented from browsing the public web but writes excerpts into a verbose run log. The verification layer needs data-handling checks, not just citation checks.

Use MCP for Approved Retrieval, Not Magical Context

MCP servers are useful when they narrow the model’s world. A Copilot workflow can connect to a document management system, an authority database, a docket source, or a matter repository through approved tools, then require generated output to cite retrieved source identifiers. That is very different from telling a model to “use the record” and hoping the record is what the user pasted into chat.

Anthropic’s claude-for-legal suite includes legal workflow components such as a docket watcher agent, privilege log reviewer, and claim chart builder.[7] Those are more useful as structured components inside a governed workflow than as proof that legal work should become free-form chat. The pattern to copy is not the branding; it is the insistence that legal tasks be decomposed into tool calls, source references, review checkpoints, and auditable outputs.

A Minimal Q3 2026 Build Plan

A legal team does not need to rebuild its entire document platform to test this architecture. Start with one repository and one matter type where the consequences are real but bounded: for example, lease abstraction, privilege log quality control, or deposition outline preparation. The first implementation should prove routing, verification, and auditability before it tries to maximize automation.

1. Create .github/copilot-instructions.md with global rules for citations, privilege, source use, logging, and attorney review.
2. Add path-specific .instructions.md files for briefs, contracts, privilege logs, deposition materials, and test fixtures.
3. Create CLAUDE.md for agent rules: tool boundaries, escalation triggers, review requirements, and prohibited autonomous actions.
4. Install hooks in .github/hooks/*.json for citation verification, privilege metadata checks, source-presence checks, and blocked placeholder detection.
5. Configure MCP servers only for approved repositories, authority stores, docket systems, and matter sources.
6. Route routine repository work to Copilot with Opus 4.8 and route high-stakes legal reasoning to Opus 5 through an API service that logs request metadata, source sets, reviewer identity, and final disposition.

The API service for Opus 5 should not be a thin wrapper around a prompt box. It should accept a task type, matter identifier, source bundle, jurisdiction, reviewer, and output format. It should reject requests that lack an approved source set. It should preserve enough metadata to reconstruct what the model saw and what the reviewer approved, without retaining privileged payloads outside approved systems.

{
  "task_type": "privilege_log_review",
  "model": "claude-opus-5",
  "effort": "high",
  "matter_id": "approved-matter-id",
  "source_bundle_id": "approved-source-bundle",
  "jurisdiction": "specified-by-requester",
  "required_outputs": [
    "risk_flags",
    "source_row_references",
    "reviewer_questions",
    "no_final_waiver_determination"
  ],
  "human_review_required": true
}

The field names are more important than the syntax. They force the requester to say what legal task is being performed, what sources are authorized, which jurisdiction controls, and what the model is not allowed to decide. That is how the Opus 5 call becomes part of a legal workflow rather than a side conversation.

What Not to Route Through This Setup

Some work should be rejected rather than routed. Do not send privileged material through a model or Copilot configuration with retention terms the legal organization has not approved. Do not ask Copilot to generate final filing text from model memory. Do not use Opus 5 API calls as a workaround for missing source collection. Do not let agents file, serve, certify, or transmit legal documents without human signoff.

The older AI Vortex guide on Claude Opus 4.7 and GitHub Copilot remains useful as an architectural precursor because it treats Copilot as part of a controlled legal engineering environment rather than a generic chat surface.[8] But it is a generation behind the Q3 2026 question. The current decision is no longer simply whether Claude belongs in Copilot; it is how to run Opus 4.8 in Copilot while selectively exposing Opus 5 through a governed API path.

Fast-moving release information is another operational risk. A Coursiv guide published July 23, 2026 said Opus 5 did not exist; Anthropic released Opus 5 the next day.[9][1] The lesson is not that every guide is unreliable. The lesson is that model availability should be checked against the vendor and platform pages at deployment time, especially when the architecture depends on whether a model is available through Copilot, API, or both.

The Q3 2026 Judgment

In Q3 2026, the responsible Claude Opus 5 and GitHub Copilot setup for legal workflows is split execution with shared gates. Opus 4.8 in GitHub Copilot should handle the embedded engineering work: scaffolding, boilerplate, automation glue, tests, path-aware edits, and MCP-connected workflows. Opus 5 through the API should handle the small set of legal reasoning tasks where deeper analysis, effort control, and self-verification justify the cost and the extra governance.

The part to centralize is not the model. It is verification. Repository instructions, path-specific instructions, CLAUDE.md, hooks, MCP servers, and review requirements should sit between every model output and every legal deliverable. When Opus 5 eventually appears in Copilot’s model picker, that layer should still work. Until then, waiting for a perfect picker or forcing all work through one interface creates more risk than it removes.

References

1. What's new in Claude Opus 5, Anthropic.
2. Supported AI Models, GitHub Docs.
3. Copilot customization cheat sheet, GitHub Docs.
4. Introducing Claude Opus 4.8, Anthropic.
5. Legal summarization guide, Anthropic.
6. Claude Fable 5 is generally available for GitHub Copilot, GitHub Changelog, June 9, 2026.
7. claude-for-legal, Anthropic.
8. Claude Opus 4.7 GitHub Copilot Legal Engineering, AI Vortex.
9. Claude Opus 5 guide, Coursiv, July 23, 2026.