What an AI agent is allowed to do to your books
Every tool declares whether it reads or writes. Writing tools that touch existing records take a confirm flag defaulting to false, so the natural first call previews the exact journal lines rather than posting them. No caller can update or delete history, and no caller can post into a locked period — including the people who built this.
Permission models for agents usually mean scopes on a token. This one is mostly not that, because the more useful question is not which tools a caller may reach but what any caller is capable of doing at all.
What is actually enforced
- Every tool declares whether it mutates, and a test holds that declaration to the real implementation.
- Seven of the eight mutating tools take a confirm flag defaulting to false, so previewing is the default path. Creating a book is the exception and has nothing to preview.
- "confirm" is the only dry-run name used anywhere, so a model that learns it once applies it everywhere.
- Update and delete on journal entries and journal lines are refused by the database for every caller.
- Period locks can only move forward in time.
- A reversal cannot be reversed, and cannot cross books.
Read and write are declared, not inferred
Every tool carries an explicit flag saying whether it mutates. That flag is not decorative: it is checked against the real tool definitions by a test, and it is what the tool documentation renders, so what a page says about a tool and what the tool does cannot drift apart.
Reading tools — listing transactions, running a profit and loss statement, a balance sheet, a trial balance, the general ledger, cash position, spending summaries, anomaly detection, export — cannot change anything, whatever they are asked to do.
Preview is the default, not a feature
Every mutating tool that touches existing records takes a confirm flag that defaults to false. An assistant that calls one the obvious way gets a preview: the exact journal lines that would be posted, with the amounts, before anything is written. The single exception is creating a book, which brings an empty set of accounts into existence and has nothing to preview.
The name is deliberately the same everywhere. One dry-run concept with one spelling means a model that learns the pattern on one tool applies it correctly to all of them, and never invents a plausible alternative like dryRun or preview that would be silently ignored.
The permissions nobody has
The more interesting part of this model is the set of operations that are unavailable to every caller, regardless of key, role or intent.
- Editing a journal entry or a journal line. Refused by the database. Corrections happen by reversal.
- Deleting history, individually or by truncation. Refused by the database.
- Posting into a locked period, whatever the entry date claims.
- Reopening a closed period by moving the lock backwards.
- Reversing a reversal, or reversing an entry that belongs to a different book.
What is missing
Being specific about this is more useful than being reassuring. There are no scoped API keys: a key can call every tool, so handing one to an assistant grants everything, and the meaningful boundary today is the one above — what nobody can do — rather than a per-key permission set.
There is also no approval workflow. An assistant that calls a tool with confirm set to true writes immediately. The preview is a default, not a gate.
What this does not cover
- API keys are all-or-nothing. Read-only keys do not exist yet.
- There is no approval step: a confirmed write is written.
- Nothing prevents an assistant from posting a valid entry that describes the wrong thing. That is what reversals are for.
Common questions
- Can I give my assistant read-only access?
- Not yet. Keys are all-or-nothing. The available protection is that writing tools preview by default and that no caller can alter history.
- What if the AI posts something wrong?
- Reverse it. The reversal releases the underlying transaction so it can be categorized again, and both the mistake and its correction stay visible. Nothing is rewritten to look as though the error never happened.
- Can the AI delete my books?
- It cannot delete journal history — the database refuses updates, deletes and truncation on those tables for every caller.
Checked against the implementation on 2026-08-09.