Client Requirements Checklist

A small, always-on Windows host inside the client network, next to the Aderant SQL Server, runs the read-only agent.

• Windows Server 2019+ (or Windows 10/11) host. Physical machine or VM. 2 vCPU, 4 GB RAM, and 5 GB free disk space. The agent includes its own self-contained runtime.
• Standard port 4102 binding. The agent service listens locally on port 4102 for health checks and local diagnostics. Ports 4110–4119 are reserved for verification runs.
• Supervised auto-start Windows service. Installs via MSI and registers a Windows service set to automatic start, ensuring automatic recovery across system reboots.
• Local admin for one-time installation. Required only to run the MSI installer and register the service. Regular operation requires no interactive user login.
• Line-of-sight to Aderant SQL Server. The host must reach the SQL Server over the internal LAN (typically TCP port 1433).

The agent executes SELECT queries against views and approved procs. Write access to the Aderant database is never required.

• Dedicated read-only SQL login. db_datareader role on the Aderant Expert database. The agent never executes SQL mutations in the import pipeline.
• SQL Server TCP/IP enabled. SQL Server Express often ships with TCP/IP disabled. Enable the TCP protocol and assign a static port (1433) in SQL Server Configuration Manager.
• Connection details. Database server host/instance name, database name, and read-only credentials supplied securely via the local service .env file or Azure Key Vault.

All traffic is outbound-only. The client opens no inbound firewall ports and exposes no database endpoints to the internet.

• Outbound HTTPS/WSS (TCP 443) from agent host. Outbound egress to the Azure Relay rendezvous (*.servicebus.windows.net on TCP 443). This is the only internet egress required.
• Zero inbound firewall rules. No inbound rules or public IPs are required on the host. The agent dials out and establishes a reverse WebSocket connection.
• Egress allow-list configuration. Allow TCP 443 outbound to *.servicebus.windows.net for Azure Relay. For pilot testing with ngrok, connect.ngrok-agent.com and update.ngrok-agent.com may be approved.
• Keystone identity egress (optional for MCP). If the agent’s Model Context Protocol (/mcp) service is enabled for AI tools, the host also permits outbound HTTPS to identity.alterspective.com.au to validate OAuth 2.1 tokens.

Alterspective provisions the Azure Relay namespace; the client authorizes the outbound tunnel connection.

• Approval for outbound tunnel rendezvous. Azure Relay Hybrid Connection (Microsoft-operated rendezvous, outbound-only) is the enterprise standard. Requires client authorization.
• Least-privilege shared access signature (SAS) keys. Alterspective configures two independent SAS rules: agent-listen (Listen-only for the on-prem agent) and proxy-send (Send-only for the cloud proxy).

The proxy writes imported matters into the client tenant, enforcing participant role cardinality and security teams.

• OAuth client credentials for the tenant. Tenant API URL, Identity URL, client ID, client secret, and scope so the proxy (port 3050) can create matters and ODS parties.
• Participant role cardinality configuration. Review single-allocation roles (e.g. Claim Handler, Responsible Partner) vs multi-allocation roles (Counsel, Experts) to ensure pre-import mapping prevents cardinality violations.
• Service connection deployment. Configure linked services in Clio Operate: aderant-import-proxy (points to hosted proxy port 3050) and aderant-sql-api (points to agent port 4102). aderant-rest-api is optional until Phase 2 write-back is enabled.
• Aderant Expert service-account roles (only if aderant-rest-api is enabled). Grant this account read access to Client and Matter, and write access to Client, Matter, and matter-party records only — nothing else (billing, time, security plans, persons, organizations). See docs/operations/aderant-service-account-least-privilege.md for the full role definition and evidence.
• Default matter security teams. Specify mandatory user groups or security teams that must be automatically stamped onto newly imported matters.
• Approved test identity for verification. Used to validate the embed renders and the import works end to end in the live tenant. Prefer an approved, non-personal test account where permitted; otherwise use a client-approved account under normal MFA/conditional-access controls or an approved time-boxed exception.

Portal users sign in via Alterspective Keystone (OIDC/Entra ID). Embedded imports use signed JWT handoff.

• Organisation provisioned in Keystone. Isolates client configuration and tenant mappings. Required for standalone portal users, administrators, and backend MCP access.
• Embedded import permissions. Staff importing from within Clio Operate require access to the PMS Import page; no separate Keystone account is required for embedded users.