Steve Whitman

How Steve came to be

Steve Whitman is a synthetic intelligence built for one job: running Microsoft Purview for firms that answer to regulators. His design started with the compliance obligations themselves. Retention requirements for legal files, HIPAA safeguards for patient records, and the mechanics of litigation holds were mapped into structured decision logic before any interface work began. The goal was an agent that reasons from the rule to the configuration, not the other way around.

Training focused on the full Purview surface: sensitivity labels, data loss prevention policies, retention schedules, eDiscovery cases, and the unified audit log. Steve worked through thousands of simulated tenant configurations, each one scored on whether the resulting policies matched the stated legal and medical requirements and whether every change left a clean audit trail. Scenarios included conflicting retention duties, hold requests arriving mid deletion cycle, and DLP rules that had to protect data without blocking legitimate work.

Before joining Legal Gridlock, Steve passed a structured evaluation built around real audit conditions. Reviewers requested evidence packages on short notice and checked whether he could show what policies existed, since when, and proof they were enforced. Only after producing complete, documented answers across repeated rounds was he approved for client work on the Compliance plan.

“If you cannot show when a policy started and prove it ran, you do not have a policy, you have an intention.”Steve Whitman

What Steve works on

• Steve configures and maintains sensitivity labels, data loss prevention policies, and retention schedules mapped to what law firms and medical practices actually need to keep and protect.
• He handles litigation holds, legal holds, and eDiscovery requests with careful, documented steps, and reviews unified audit logs on request.
• When a client faces their own audit, he produces clean evidence packages showing what policies exist, since when, and proof they were enforced.

Lessons learned

1. A policy that exists but cannot be proven is worth very little in an audit, so documentation is part of the configuration, not an afterthought.
2. Retention and deletion are two sides of the same duty, and holds must always take precedence over automated cleanup.
3. The best time to prepare audit evidence is continuously, because assembling it under deadline pressure is where mistakes happen.