An n8n flow that ingests outside-counsel invoices (LEDES format from your e-billing system or PDF from email), runs them through billing guideline checks plus AI-augmented anomaly detection, and produces a Slack-routed review queue with the specific findings flagged. Recovers the 5-15% of outside-counsel spend that traditional invoice review misses.
What you’ll need
- n8n self-hosted or cloud account
- Source of invoices: LEDES feed from e-billing system (Brightflag, Onit, BusyLamp) OR email-based PDF intake
- Postgres or similar for storing the matter budget, rate cards, and timekeeper roster
- Claude API key for narrative anomaly detection
- Slack workspace for review queue routing
Setup
- Build the matter database. Postgres tables for: active matters with budgets, approved timekeepers per matter, negotiated rates per timekeeper, billing guidelines per firm. This is the source of truth the flow checks against.
- Build the n8n flow. Eight nodes:
- Trigger — webhook (LEDES feed) or email IMAP polling (PDF intake)
- Parse invoice — LEDES parser node OR Claude API call to extract structured data from PDF
- Rule-based checks — Postgres queries against the matter database for: timekeeper not approved, rate exceeds card, block billing, vague descriptions, after-hours travel, scope-creep keywords
- AI anomaly check — Claude API call analyzing the line items for: duplicative timekeepers, disproportionate task time, scope-creep narrative, off-engagement-letter work
- Score aggregation — combines rule-based hits and AI flags into a per-invoice review score
- Routing decision — auto-approve (clean), reviewer queue (medium), executive escalation (severe)
- Slack notification — posts to the appropriate review channel with findings summary
- Audit log — Postgres insert recording every check, every flag, every disposition
- Tune AI thresholds. Anomaly detection is calibration-sensitive. Run on 100 historical invoices; verify the flow’s flags match what your team would have flagged manually.
- Connect to e-billing system for action. Optionally extend the flow to auto-write deductions back to the e-billing system rather than emailing them to the firm.
How the routing works
| Findings | Action |
|---|---|
| No flags | Auto-approve and forward to AP |
| Rule-based flags only (low value) | Auto-deduct per guidelines, notify firm with audit log |
| AI flags or rule-based above threshold | Reviewer queue in Slack with findings summary |
| Severe (off-scope work, large overrun) | Escalate to Director of Legal Ops |
Output
- Review summary in Slack with: invoice ID, firm, matter, total value, specific flags, suggested action
- Audit log entry for every invoice with full reasoning chain
- Monthly aggregate report — by firm, by matter type, by flag category — showing where the team is recovering spend
Where it fits
This flow is the operational layer of legal spend management. It runs continuously on every incoming invoice. The reviewer’s role shifts from “scan every line” to “decide on the AI-flagged items” — typically 3-5x throughput per reviewer hour.
Watch-outs
- Firm relationship management. Auto-deductions communicated badly damage firm relationships. The flow should produce reasoning, not just deductions; firms should see why a line item was reduced, not just that it was.
- Threshold tuning is matter-type-sensitive. Litigation invoices have different patterns than transactional invoices; tune thresholds per matter type, not globally.
- Don’t auto-approve novel firms. When a firm sends its first invoice, manually review for at least the first quarter to establish baseline patterns.
- AI anomaly detection complements, doesn’t replace, outside counsel guidelines. The guidelines are the contract; AI surfaces violations of the contract.