Section 1
Where the exposure actually sits
Four categories cover most of it. Confidentiality first: many commercial contracts restrict naming the counterparty at all, and a signed non-disclosure agreement usually survives the end of the engagement. Second, substantiation. A published performance claim needs a file behind it, and the file needs to have existed before the claim did. Third, personal information. Customers, employees, and beneficiaries appearing in a story are identifiable people with rights over how their details are used, and consent for one use is not consent for another. Fourth, statements about third parties. An account of a supplier failure that a reader could check against a named company is a different kind of writing from a general lesson learned. Impact organisations meet the same set of constraints, as [Storytelling for Social Impact Entrepreneurs](/blog/storytelling-for-social-impact-entrepreneurs) describes.
Section 2
Consent is specific, not general
A verbal yes on a call is not usable consent. Workable consent names four things: what will be said, where it will appear, for how long, and how the person withdraws it. Absent those, you have goodwill, which evaporates the moment the relationship sours or the contact leaves for a competitor. The withdrawal clause is the one founders skip and later need. Include a plain commitment to remove the story within a stated period on request. It costs almost nothing, it makes people more willing to agree in the first place, and it removes the worst version of the conversation.
Section 3
Keep an approval trail
For every published story: who approved it, on what date, against which draft, and what evidence supports each factual claim. Store it where a successor can find it. Formats are shifting quickly, which is why [The Future of Storytelling in Business: Trends to Watch](/blog/the-future-of-storytelling-in-business-trends-to-watch) is worth reading alongside this.
Section 4
Substantiating the claims inside the story
Treat every number in a case study as a claim you may have to defend. That means an identifiable source, a defined period, and a note of what else was changing at the time. A figure taken from a client's verbal recollection is not evidence, however sincerely offered. Typicality is the second test. Publishing your best outcome as though it were the normal one is where marketing claims most often become a problem, and adding the range of results you actually see is usually enough to fix it. Composites need disclosure. Merging three clients into one anonymised account is a legitimate technique and becomes misrepresentation the moment it is presented as a single real engagement. Employee stories carry an extra consideration: staff cannot freely refuse a request from their employer, so consent there deserves more care, not less.
Section 5
The questions law does not settle
Plenty of storytelling is entirely lawful and still corrosive. Publishing a client's failure to make your intervention look better. Telling a departed employee's story without their knowledge. Using a beneficiary's hardest moment as an acquisition asset. The practical filter is the direct reading test: if the person in the story read it as written, would they recognise themselves and consider it fair. If not, the risk is not primarily legal, and it will surface as a relationship rather than a letter. One necessary caveat. This is an operating checklist, not legal advice, and the rules vary by jurisdiction and by sector. Anything with real money attached deserves a lawyer, and the changing economics of that are covered in [AI Automation in Legal Services](/blog/ai-automation-in-legal-services).