How attorney-client privilege actually works