Contract Review Assistant Blueprint
A complete architecture for an AI-powered contract review tool — upload portal, clause-extraction prompt chain, risk scoring API, summary generation, and an admin dashboard for legal ops. 15 nodes, ready to export to Cursor or Claude Code.
What this app does
A contract review assistant automates the first pass of legal contract review. Legal teams upload contracts (PDF, DOCX, or text). The AI extracts key clauses — termination, liability, payment terms, IP ownership, confidentiality — scores each for risk, generates a plain-English summary, and flags anything that needs human attention. A legal ops admin reviews the AI's analysis before anything is acted upon.
This blueprint maps out 15 nodes across frontend pages, backend APIs, AI prompts, databases, and human checkpoints. It's designed for an internal legal ops team processing 20-100 contracts per week.
Architecture diagram
Node breakdown
Frontend pages
- Upload Portal — drag-and-drop interface for uploading contracts (PDF, DOCX, TXT). Shows upload progress, parsing status, and initial AI analysis queue. Supports batch uploads with metadata tagging (counterparty, contract type, value).
- Review Dashboard — list view of all contracts in the review pipeline. Shows contract name, counterparty, risk score (color-coded: green/amber/red), extraction status, and review stage. Filters by risk level, status, and date.
- Contract Detail — full analysis view: extracted clauses with risk scores side-by-side with the original contract text, AI-generated summary, flagged clauses needing attention, and reviewer notes. Includes approve/reject/request-revision actions.
- Admin Panel — manage team members and roles, configure risk thresholds (e.g. auto-flag any clause with risk score above 0.7), view audit logs, and export review reports.
Backend APIs
- Contracts API —
POST /api/contracts/upload(upload + parse),GET /api/contracts(list with risk scores),GET /api/contracts/:id(full detail with clauses). - Clauses API —
GET /api/contracts/:id/clauses(all extracted clauses),PATCH /api/clauses/:id(update reviewer notes or risk override). - Risk Scoring API —
GET /api/contracts/:id/risk(overall risk score + per-clause breakdown),POST /api/risk/recalculate(re-score after edits).
AI prompts (prompt chain)
- Clause Extraction — input: full contract text; task: identify and extract key clauses (termination, liability, payment, IP, confidentiality, indemnification, force majeure); output: structured list of clauses with their text and clause type. This is a prompt chain — the AI processes the contract section by section.
- Risk Assessment — input: individual clause text + clause type + standard clause template; task: compare against standard terms and identify unusual or unfavorable provisions; output: risk score (0-1), risk level (low/medium/high), and explanation of what's unusual.
- Summary Generator — input: all extracted clauses with risk scores; task: generate a plain-English executive summary of the contract's key terms and risks; output: 3-5 paragraph summary covering parties, key obligations, notable risks, and recommended actions.
Human checkpoints
- Review Checkpoint — after the AI extracts clauses and scores risk, a legal team member reviews the analysis in the Contract Detail page. They can override risk scores, add notes, and flag clauses for deeper review. No risk score is finalized until a human reviews it.
- Approval Gate — before the contract summary and risk assessment are shared with stakeholders or added to the official record, an admin approves the review. This ensures the AI's analysis has been validated by a qualified legal professional.
Databases & services
- Contracts DB (PostgreSQL) — tables: contracts (id, filename, counterparty, type, value, status, uploaded_by, created_at), clauses (id, contract_id, clause_type, text, risk_score, risk_level, reviewer_notes, reviewed_by, reviewed_at), summaries (id, contract_id, summary_text, recommended_actions, created_at).
- Users DB — users (id, email, name, role, bar_number, created_at), roles: uploader, reviewer, admin.
- Audit Log — audit_entries (id, user_id, action, contract_id, clause_id, old_value, new_value, timestamp). Tracks every change to risk scores, reviewer notes, and approval status for compliance.
How it works end-to-end
- A team member uploads a contract via the Upload Portal with metadata (counterparty, type, value)
- The Contracts API parses the document and stores it in the Contracts DB
- The Clause Extraction AI prompt chain processes the contract, identifying and extracting key clauses
- Each extracted clause is sent to the Risk Assessment AI prompt, which compares it against standard terms and assigns a risk score
- The Summary Generator AI prompt creates an executive summary from all clauses and risk scores
- The contract enters the Review Checkpoint — a legal team member opens the Contract Detail page, reviews each clause's risk score, adds notes, and overrides scores if needed
- Once the review is complete, the contract goes to the Approval Gate — an admin approves the review for stakeholder distribution
- All actions (uploads, risk overrides, approvals) are logged in the Audit Log for compliance
- The Review Dashboard shows the contract's progress through this pipeline in real time
The prompt chain is what makes this architecture work. Clause Extraction runs first, then Risk Assessment runs on each clause individually, then Summary Generator synthesizes everything. Breaking it into a chain — rather than one massive prompt — produces more accurate results and lets humans review each stage independently.
Cursor export prompt
Open this blueprint in Bluemoonkey and export it, or copy the prompt below directly into Cursor's Agent mode:
Build this app exactly as described.
Start with database schema and auth, then APIs, then frontend pages.
## Upload Portal (Frontend Page)
Drag-and-drop interface for uploading contracts (PDF, DOCX, TXT).
Shows upload progress, parsing status, and analysis queue.
Supports batch uploads with metadata (counterparty, type, value).
## Review Dashboard (Frontend Page)
List of all contracts in the review pipeline. Shows name, counterparty,
risk score (color-coded), extraction status, and review stage.
Filters by risk level, status, and date range.
## Contract Detail (Frontend Page)
Full analysis: extracted clauses with risk scores side-by-side with
original text, AI summary, flagged clauses, reviewer notes.
Includes approve/reject/request-revision actions.
## Admin Panel (Frontend Page)
Manage team members and roles, configure risk thresholds,
view audit logs, export review reports.
## Contracts API (REST Endpoint)
- POST /api/contracts/upload — upload and parse document
- GET /api/contracts — list with risk scores
- GET /api/contracts/:id — full detail with clauses and summary
## Clauses API (REST Endpoint)
- GET /api/contracts/:id/clauses — all extracted clauses
- PATCH /api/clauses/:id — update notes or risk override
## Risk Scoring API (REST Endpoint)
- GET /api/contracts/:id/risk — overall score + per-clause breakdown
- POST /api/risk/recalculate — re-score after edits
## Contracts DB (PostgreSQL)
- contracts: id, filename, counterparty, type, value, status, uploaded_by, created_at
- clauses: id, contract_id, clause_type, text, risk_score, risk_level, reviewer_notes, reviewed_by, reviewed_at
- summaries: id, contract_id, summary_text, recommended_actions, created_at
- users: id, email, name, role, bar_number, created_at
- audit_entries: id, user_id, action, contract_id, clause_id, old_value, new_value, timestamp
## Clause Extraction (AI Prompt Chain)
Input: full contract text
Task: identify and extract key clauses (termination, liability, payment,
IP, confidentiality, indemnification, force majeure)
Process: section-by-section prompt chain
Output: structured list of clauses with text and clause type
## Risk Assessment (AI Prompt)
Input: clause text, clause type, standard clause template
Task: compare against standard terms, identify unusual provisions
Output: risk score (0-1), risk level (low/medium/high), explanation
## Summary Generator (AI Prompt)
Input: all extracted clauses with risk scores
Task: generate executive summary of key terms and risks
Output: 3-5 paragraph summary with parties, obligations, risks, recommendations
## Review Checkpoint (Human Checkpoint)
After AI extraction and risk scoring, a legal team member reviews each
clause in Contract Detail. Can override risk scores, add notes, flag
for deeper review. No risk score finalized until human-reviewed.
## Approval Gate (Human Checkpoint)
Before the summary and risk assessment are shared with stakeholders or
added to the official record, an admin approves the review. Ensures AI
analysis is validated by a qualified legal professional. All actions
logged in audit_entries for compliance.For more prompt templates and tips, see our Cursor app prompt template guide. New to app architecture? Start with our guide on how to plan an app before coding.
Fork this blueprint
Open the free canvas, import this architecture, and customize it for your legal ops workflow.
Open Canvas — Free →FAQ
What is an AI contract review assistant?
An AI contract review assistant automates the initial review of legal contracts. It extracts key clauses, scores risk levels, generates plain-English summaries, and flags clauses that need human attention — all before a lawyer reviews the document. The human review checkpoint ensures no AI analysis goes out without legal oversight.
Can I export this blueprint to Cursor?
Yes. Open this blueprint in Bluemoonkey's free canvas and export it as a structured AI prompt formatted for Cursor's Agent mode. Paste it into Cursor, add "Build this app exactly as described," and it generates the full project.
How many nodes does this blueprint have?
This blueprint has 15 nodes: 4 frontend pages, 3 APIs, 3 AI prompts (including a prompt chain for clause extraction), 2 human checkpoints, and 3 data stores (contracts DB, users DB, and audit log). Every node is editable in the free canvas.
Is the AI analysis reliable enough for legal use?
The blueprint includes two human checkpoints specifically for this reason. The Review Checkpoint requires a legal team member to validate every risk score and clause extraction before it's finalized. The Approval Gate requires admin sign-off before the analysis is shared. The AI does the first pass — humans make the final call.
What is a prompt chain?
A prompt chain is when an AI task is broken into sequential steps instead of one large prompt. In this blueprint, Clause Extraction processes the contract section by section rather than all at once. This produces more accurate results and lets humans review each stage independently. Each step's output feeds into the next.