Most of the AI connections into client ledgers I’ve covered this year could read but not write, or could reach one client at a time. A practice needs both before an agent, AI that works through a task’s steps on its own, can do real work across a client base. On October 13 Digits added writing to a connection that already reached every client, and Xero shipped client switching the next day, on Google’s assistant only. The same day as Digits’ launch, the largest bank in the US said outside agents won’t be signing in to its customers’ accounts, and two days later a fintech let ChatGPT and Claude move money.
This week: the checklist a ledger connector has to pass for a practice, where the banks are drawing their line, why that line sits in roughly the right place even if the banks can’t hold it forever, and the agents getting job titles before they get the job.
1. The connector checklist: it writes, it reaches every client, and it knows which clicks are yours
An agent opens the file, does the work, and posts the result, where a chatbot answers a question and stops. The connection it uses is usually MCP, the Model Context Protocol: an open standard that lets an assistant like Claude or ChatGPT read from and write to another piece of software, much the way a bank feed lets your ledger read the bank.
Digits, the AI-first general ledger, launched its MCP in April as read-only. On October 13 it added 18 write tools: the agent can recategorize, edit, split, and delete transactions, post journal entries, create, code, approve, and delete bills, create, edit, void, and delete invoices, and create, edit, or archive accounts in the chart of accounts. It’s free on every plan, works with Claude and ChatGPT, and runs as you, with “only the write tools your Digits role allows.” One connection also reaches every client you can see: a tool called list_businesses returns “all businesses you have access to in Digits, including both direct and affiliated entities,” and the agent selects one, works it, and moves to the next.
Digits’ launch post carries the practice example: “My staff accountant ran two clients’ Q3 closes through Claude on the Digits MCP.” The firm, Arclow, says the work went from about seven hours by hand to about an hour and 40 minutes, and “a licensed CPA reviews every close.” That’s one firm and two clients, relayed by the vendor, so read it as an illustration.
The most useful part of the launch is the list of what the agent can’t do. Digits’ help page says, “If you can’t do something in Digits, your AI can’t either,” so ask the reverse: what can a person do that the agent can’t? The agent “cannot send invoices, pay bills, or move money”; an invoice it creates stays in Draft, and approving a bill posts it to the books without scheduling a payment. It can’t lock or unlock a period or approve a change to a locked one, only propose it. It has no reconciliation tools, so uploading the statement, clearing the flags, confirming a $0.00 difference, and clicking Finalize stay with a person, and so do connecting a bank and inviting a user.
Lock, reconcile, pay, send, connect, invite: through the MCP, those stay human clicks, and they’re most of the control points in a close. Bill approval is the exception, and it’s worth noticing that it’s on the agent’s side of the line.
Two cautions come with it. Changes to a locked period queue for an approver, but “if the period is open, the changes apply automatically,” so the review of open-period work is a step your firm has to design. And because the agent works one selected client at a time, confirm which client it’s in before you trust a figure.
Xero delivered the client-switching half, partly. Its Google Gemini app was announced October 14, and Xero’s October 16 blog says accountants “can switch between their practice’s client organisations without leaving Gemini.” The release says the same capability is coming “across all of these integrations,” which includes Claude and ChatGPT, with no date. Until then the evidence runs the other way: Xero described its September Claude integration as one client organization at a time, a request on Xero’s own ideas board for multi-organization access has sat at “Gaining Support” since June with 99 votes, and a user reported the one-organization limit in ChatGPT on the day of the release. Xero requires “explicit user confirmation” before “any operation that modifies financial data,” but I haven’t seen a write path a practice can use yet.
Digits isn’t the first ledger to let an agent write, because Kick’s MCP already does, and Gusto opened a multiclient MCP to accounting firms earlier this month. Digits now has both halves in one connection and a published list of the clicks the agent can’t make. That gives you three questions for every ledger vendor your clients use:
- Does the connection write, or only read?
- Does one connection reach every client you’re responsible for?
- Which actions stay with a person, and does that list match your firm’s control points?
2. JPMorgan drew its line at the customer’s password
On JPMorgan’s October 13 earnings call, Jamie Dimon said the bank uses agents internally and will keep doing so, but “we’re not going to allow just any outside agent to come inside the company,” because “that’s just too risky for clients and for JPMorgan. You don’t want rogue agents.” A spokesperson gave Fortune the policy behind the line: “When we detect a third-party agent attempting to access accounts by obtaining customers’ banking credentials, we do not allow it.” The Financial Times reported Citi and Bank of America restricting agents the same week.
The spokesperson’s next sentence matters as much: “We support secure, customer-authorized data sharing through open banking providers.” Open banking is the permissioned route an aggregator such as Plaid uses to pass account data to an app with the customer’s consent, without the app needing the customer’s password. So the door JPMorgan shut is the one where an agent signs in as the customer. The read-only channel, where the bank knows who authorized which data, stays open.
Coming from a bank that size, that’s no surprise. Security and authorization are what a bank has to answer for when software touches money, and a bank that lets an agent sign in with a customer’s password can’t reliably tell the customer from the agent, or know what the customer authorized it to do. The agents in the coverage were consumer products like Meta’s Muse, and nothing JPMorgan said addresses business accounts or bookkeeping software.
On October 15 Mercury went the other way. Mercury, a fintech that offers accounts through partner banks and built its business with startups and technology companies, now lets ChatGPT and Claude “move money, pay a recipient, or categorize transactions,” with the rule that “nothing moves until you approve it.” For a fintech whose customers are already running agents, saying yes is the product.
How long the large banks can hold their line is the question I’d watch. My guess is not long, because customers whose agent can pay a bill from one account and not from another will notice, and the likely outcome is that the large banks build their own approved channel for agents. For your practice the immediate point is narrower. An agent that pays your client’s bills pays out of your client’s bank account, and that bank’s policy decides what the agent may do. For each client whose payables you’d hand to an agent, find out which bank it is and whether that bank has said anything about agent-initiated payments.
3. The goal is parity, and the price of parity is authorization
The end state for these connections is that almost anything a person can do in the software, an agent can do too. The condition is that every action is visible, traceable to a person, and arrives through a channel that knows who authorized it.
Digits shows that the capability already exists and that the line is drawn at the channel. Its MCP, the door your assistant uses, stops at the payment. Its separate Connect API (an API, or application programming interface, is the published route one piece of software uses to talk to another) has an endpoint that “pays one or more approved bills” through Digits’ payment rails, behind its own permission and Digits’ process for approving which apps can use it. The same capability sits behind two doors with different keys, which is exactly the shape of JPMorgan’s policy.
Some restrictions are warranted on their own merits. A research team this month tested 273 open-source MCP servers, the kind anyone can find online and add to an assistant, and found 253 verified vulnerabilities across 118 of them. The paper names no accounting software among them, but every one is a door someone in a firm could add without asking IT. And for some actions, paying a new vendor or changing a client’s payment details, you want to know the person really made the request.
When you assess any connector, I’d look for four things. First, the agent has its own credential, so its actions can be tracked as its own; the next best is that it acts on behalf of a named person with that person’s permissions, and never through a shared login. Second, the record shows what the agent did and whom it was acting for; Digits fails this one today, because agent changes log under your name and “there is no separate AI log.” Third, anything that moves money or speaks for the firm needs a confirmation from a person who meant it. Fourth, someone can stop it.
Microsoft’s Satya Nadella put the fourth test and the whole principle in two lines on October 10: “An authorized person should always be able to pause or shut down a model mid-task,” and “we need to separate the supply of intelligence from the authority over it.” Thursday’s article said to limit what the agent can do rather than what it can read. Parity is where that leads once the authority is in place: the capability can grow as fast as the vendors build it, provided every consequential action still runs through a person who’s allowed to take it.
4. The agent is getting a job title before it gets the job
Workday announced its “Autopilot” agents on October 13. The accounting agent extracts terms from contracts, prepares the entries, recommends “rev-rec and billing schedules,” and tests transactions in the background for audit readiness. The payroll agent checks for missing pay data before a run. Both reach early adopters in “early calendar 2027,” with no general release and no price, and Workday’s product president, Gerrit Kazmaier, supplied the line I’d keep: “Probabilistic AI is great at guessing, but in payroll and finance, a good guess isn’t good enough.”
What’s further along is the identity layer around the agent. Workday customers “choose which tasks run automatically and which need review,” and every agent action is logged, “including who approved.” The same day Workday agreed to buy C1.ai, a platform that gives people and agents scoped, time-limited access across systems such as email, CRM, and finance, with human approval and a log of every action. “Headless can’t mean lawless,” Workday’s CTO said; headless means software run by other software, with no person at a screen.
Xero’s October 14 announcement belongs here too. Most of it is a fourth version of the connectors it already has for Microsoft 365, Claude, and ChatGPT. The new part is “tasks”: scheduled workflows on live Xero data, such as a daily summary of pending bills and cash position, or overdue-invoice follow-ups prepared from Xero and Gmail, with confirmation before anything changes or goes out. They’re “coming soon” for “customers on eligible plans,” with no date and no plan named, so for now it’s a promise.
Workday’s agents don’t reach anyone until 2027, and Xero’s tasks have no date. What’s arriving first is the permission and the log, which is the right order, though not every vendor is following it: Digits shipped a writing agent whose log can’t tell you which changes it made.
Quick hits
The MCP roundup. New connections arrive every week now, so they only get a full block when they show a pattern, as this week’s did. The rest, in brief:
- Kick (October 16) shipped a chart-of-accounts editor for every workspace and firm templates you can “roll out to new or existing clients” in bulk, with a preview before merging. Its MCP can reorganize a chart or turn a spreadsheet into a template.
- Double (October 15) added Xero to Ask Double, read-only and in beta, and consolidations across QuickBooks Online clients, in beta on its Scale plan.
- Oracle NetSuite QuickStart (October 14) is a free AI-first ledger for eligible US early-stage tech startups, with MCP access from Claude and ChatGPT and a cap of 2,500 new records a month. Oracle calls it “a seamless and automated path to NetSuite” and names no role for accountants.
- Workday (October 13) made its agent-ready tools for HR and finance, its MCP, generally available to customers building their own agents.
- OpenAI (October 15) now lets ChatGPT Business and Enterprise admins install, enable, or disable up to 25 plugins, the add-ons that connect ChatGPT to other software, at once.
Intuit’s AI tools reach Canada, and the QBOA end date is on the page. Intuit took Intuit Intelligence international on October 14: automations, autonomous invoicing, and conversational reports in beta for QuickBooks Online and Advanced, plus an Accountant Suite with cross-client insights, Firm Playbooks to “set up standards once and apply them to new clients,” and a unified inbox. The Canadian pages say QBOA is “discontinued December 2026, evolving into IAS,” that the firm-side Accelerate tier is “free beta through end of 2026” with paid plans after and no Canadian price, and that ProAdvisor becomes ProPartner in early 2027. On the client side, “Intuit may introduce fees for beta features later.” If you’re a Canadian firm on QBOA, you’re budgeting for January against a number Intuit hasn’t published, so ask your Intuit contact for the Canadian price before you plan around it.
Your firm’s inbox has a buyer. Mode, through a program called BizBuyData, is telling accounting firms with ten or more employees that “your company’s data could be worth $100K–$5M.” What it buys is a de-identified copy of the firm’s working life: email, calendar, documents, chat, calls, CRM, and billing, from systems it names including Gmail, Outlook, Slack, NetSuite, and QuickBooks. The firm signs in to the approved systems and Mode exports the copy, and the page says nothing about client consent.
In the US, much of a tax firm’s document store is tax return information under IRC §7216. Wherever you practice, all of it sits under your confidentiality rule, whether that’s the AICPA Code or your provincial rules of professional conduct. Whether a de-identified copy sold for AI training counts as a disclosure under either is a question for your lawyer before anyone in the firm opens the calculator. Thursday’s article asked whether the machine is allowed to read what your clients sent you; this is the same pile, with a price on it.
Two-thirds of small tax firms aren’t enforcing the control that stops email forged in their name. Hub Software scanned the public records of 3,609 US tax practices with two to eight preparers and found 34% enforcing DMARC, the setting in your domain’s records that tells other mail servers to reject or quarantine email pretending to come from your firm. On Google Workspace the figure was 12%, against 37% on Microsoft. Many firms have DMARC published at “p=none,” which means monitor only and blocks nothing. It’s a vendor’s scan and the report’s figures don’t reconcile exactly, but the direction is clear.
DMARC protects your clients, and their assistants, from an instruction in your name that you never sent, and last week’s roundup covered the email written for the assistant to read. The IRS’s Tax Professional Awareness Week starts October 19 with cybersecurity on the agenda, which makes this a good week to ask whoever runs your email whether your domain is set to “p=none.”
The week in one line
The connector a practice needs now exists in at least one ledger, and the argument has moved to the channel. Which door the agent comes through, and who stands behind it, will decide how far it’s allowed to go. The banks will open their own channels eventually, because their customers will ask, and the platforms your clients stay on will be the ones that make every agent action traceable to a person who meant it. The question for your firm is whether you’ve written down which of your people can authorize which agent to do what, and for which client.
If you want your AI champion to be the one who writes that down, the next Practice Transformation Program cohort starts Wednesday, November 11. Four live three-hour sessions, nine modules, and a transformation plan your firm actually executes. US$2,997, and enrollment closes Sunday, November 1, at theaiaccountant.ai/transformation.