Renzo DemartiniIn short
- An assistant connected to your ledger can do what the person who connected it can do, so the first decision is whose login it uses.
- Treat read, draft, approve and pay as four separate permissions, and give approving and paying to two different people.
- Xero logs the API calls an agent makes but not the prompts behind them, so keep your own record of what it was asked and who approved.
An AI assistant connected to your ledger has no authority of its own. It can do what the person who connected it can do.
That makes it a controls question before it is a technology one. Reading, drafting, approving and paying are four different permissions. A growing business should decide each one on purpose.
Half of Xero’s open-source MCP tools can change the books, payments and journals included
Read
26
Tools that only read
Lists and reports
Write
25
Tools that create, update, delete or approve
Including payments and manual journals
None
0
Tools that approve a bill or purchase order
One approves a payroll timesheet
Xero’s open-source MCP server for developers, version 0.0.16: 51 tools, counted from its README on 1 November 2026.
Decide first: read, draft, approve, pay
Reading is low risk; approving and paying should sit with two different people
| Permission | What the assistant does | Who holds it | Ask for |
|---|---|---|---|
| Read | Answers questions from live data | The assistant, on a named login | Read-only access |
| Draft | Creates or edits a bill, invoice or journal | The assistant, as a draft | Drafts kept apart from approval |
| Approve | Releases a draft into the books | A person with the authority | A confirmation step before any write |
| Pay | Moves money out of the bank | A second person, never the assistant | Payments left out of its access |
Split the permission before you pick a tool. Reading is low risk. Drafting is a write, but nothing is final until a person approves it. Approving and paying are the two that move money, so give them to two different people.
Write one line for each assistant: what it may read, what it may draft and who approves.
Pick the tool by what it can write
Xero’s Claude connector only reads; a developer MCP server can also write
Xero’s Claude connector
- Read only at launch
- Follows your Xero permissions
- Cannot create, edit, approve, reconcile or pay
A developer MCP server
- Reads and writes Xero data
- V1 tools do not ask you to confirm a write
- Each call runs against one organisation
Xero offers two routes, and they are different products. Its connector in Claude reads and answers questions. A developer MCP server can also write, and Xero’s own FAQ says its V1 tools do not ask you to confirm before they change data.
I work with any system that has an API key or an MCP connector, and the first question is always what it may write. Start with the read-only route.
More detail
Checked on 1 November 2026. Xero’s page for the Claude connector says: “The connector and plugin are read-only and follow your Xero permissions”. It adds: “Claude can’t create, edit, approve, reconcile or pay in Xero”. The page calls the connector read-only at launch, so check it again before you decide.
Xero’s developer FAQ says the Remote MCP server offers tools that read and write Xero data. It also says: “The tools on V1 do not elicit user confirmation”. And: “Always ask your agent to confirm with you before writing anything back to Xero”. Each call runs against a single organisation. Xero’s open-source MCP server lists create-payment and create-manual-journal among its tools.
Limit what the login can reach
A named user and narrow scopes cap an assistant before any rule is written
- 01Use a named user
Pick the login by its role. Avoid an administrator’s.
- 02Ask for the narrowest scopes
Read scopes first. Add write scopes one at a time.
- 03Keep journals and payments out
Add them only when a person approves each one.
- 04Review the connection
Disconnect it when the person who authorised it leaves.
An app works as the person who authorised it. Xero says apps using its API have the access of a Standard or Advisor role user. So connect with a named user whose role you chose, not an administrator’s login.
Then narrow the scopes. Xero is replacing its broad transactions scope with narrower ones, such as invoices alone. Journals sit behind Reports access.
More detail
Checked on 1 November 2026. Xero’s developer changelog (6 August 2026) says: “Apps created on or after 2 March 2026 already use granular scopes”. It adds: “Existing apps have until 13 September 2027 to migrate”. Xero’s developer FAQ says the authorising user must have Reports access to reach the journal endpoints. It also says the user who authorised can disconnect access from their Connected Apps page. Roles and scopes change, so confirm them on Xero’s pages for your own file.
Keep your own record
Xero logs the calls, not the reasons, so the reasons are yours to keep
Xero records
- Every API call, under the app
- In the developer portal
You keep
- What the assistant was asked
- Why, and what it changed
- Who approved the write
Xero logs every API call an agent makes in its developer portal, under the app. It does not log the tool calls or prompts behind them. The reason for a change is yours to keep.
Keep a short log: what the assistant was asked, what it changed and who approved it.
More detail
Checked on 1 November 2026. Xero’s developer FAQ says: “Every Xero API call your agent makes is logged in the Developer Portal, under the app you own”. It adds: “Only the API calls are logged, not the tool calls or prompts behind them”.
Where a tool touches personal information, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Get privacy advice where your situation is unclear.
Separate the duties, as you would for a person
The assistant may record; two people authorise and pay
| Duty | Before an assistant | With an assistant |
|---|---|---|
| Authorise | A manager approves | A named person approves, never the assistant |
| Record | A bookkeeper enters it | The assistant drafts; a person reviews it |
| Hold the money | The owner or finance lead pays | A second person releases the payment |
The auditing standard defines segregation of duties as giving different people the jobs of authorising transactions, recording them and keeping custody of assets. An assistant can take the recording. It should not take the other two.
A small business can still do this. In an owner-managed entity, the standard notes, the owner’s direct oversight may compensate for fewer people.
More detail
Checked on 1 November 2026. ASA 315 (compiled December 2023) defines it as: “Assigning different people the responsibilities of authorising transactions, recording transactions, and maintaining custody of assets”. Its note on smaller entities says the owner-manager “may be able to exercise more effective oversight through direct involvement than in a larger entity”.
ASIC’s review of how financial services licensees govern AI asks a question that fits here. It is in REP 798, published 29 October 2024: “Who is accountable for AI use and outcomes, at model level and overall”?
What to do first
One page per assistant shows who may read, draft, approve and pay
- 01List what is connected
Every assistant, plugin or agent that can reach the ledger.
- 02Write read, draft, approve, pay
One line for each: who holds each permission.
- 03Start read-only
Add write access one scope at a time, with a named approver.
- 04Review the log each month
Check the log of requests against the changes in the ledger.
A one-page list is enough to start. Begin with the assistants that can already reach the ledger.
Common questions
What is AI in finance?
In a finance team it means software that reads, drafts or flags transactions, such as an assistant connected to the ledger. The board’s question is what it may read, write, approve or pay.
Can an AI assistant change my Xero data?
Xero’s Claude connector is read-only at launch. A developer MCP server can read and write, so each write needs a person’s check. Which one you have decides what it can touch.
Who is accountable when an AI assistant gets it wrong?
A person has to be. Name the person who authorised the connection and the one who approved the change. ASIC’s review of AI governance asks who is accountable for AI use and outcomes.
Should I put customer or staff details into an AI tool?
The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Check the tool’s terms and get privacy advice where it is unclear.
What is segregation of duties?
Different people authorise transactions, record them and keep custody of assets. It reduces the chance that one person can make and hide an error or fraud.
Chartered Accountant (CA ANZ) and finance executive, based in Canberra. Practical AI and automation for SMEs, and adviser to owners, CEOs and boards on integration and finance.