Official Information Request Auditor

Background

Responding to a legal Official Information Act request at a small practice means searching inboxes, judging relevance, redacting third-party information by hand and compiling the result. It is several hours of paralegal work and every step is a place to miss something.

What I built

A five-phase pipeline: ingestion and deduplication across two Gmail inboxes at both message and thread level, a loop with rate-limited LLM relevance filtering, per-email thread retrieval and PII redaction, post-loop compilation into a master document, and audit closure in Google Sheets.

How it works

Three things shaped the build:

• Every email has to keep its own identity through the pipeline, or the audit trail cannot be closed. The message ID is carried through the LLM and upload steps in execution-scoped storage and recovered at the end, because both of those steps discard whatever they are handed.
• Nested MIME email bodies are parsed with a recursive traversal, since a flat lookup breaks on multi-part emails with attachments or rich formatting.
• The redaction prompt uses an explicit protected-entity whitelist, so the requesting parties' own names are never redacted alongside genuine third-party information.

Outcome

A set of individually redacted, audit-logged disclosure documents plus one compiled master document with a cover page, ready for legal disclosure. End-to-end process automation of this kind is routine in software engineering and rare in legal compliance, where manual review is still the norm.

Relevance filtering and redaction are both model judgements, and a model can be wrong in either direction, so a person reviews and signs off the output before anything is disclosed. The audit log against each document is what that review reads.

Both inboxes and the Drive and Sheets audit trail run inside the practice's Google Workspace Business account, and the LLM steps use a billed Gemini API key rather than the free tier, so none of it, inbox content, redaction output or audit log, is used to train Google's models. The pipeline itself is an API connection into existing accounts rather than a third-party service holding a copy of the data.