Financial Cents has connected AI assistants to accounting client records and tells users up front that the assistant cannot delete anything. The permission I would watch is a different one: sending a message to a client.
What one vendor has shipped
On 20 October 2026 Financial Cents, a practice management provider for accounting, tax and bookkeeping firms, launched a Model Context Protocol (MCP) server. It lets a firm connect its account to assistants such as Claude, ChatGPT and Gemini. Its product page lists what a connected assistant can do within the user’s own permissions: view and update clients, projects, tasks and time; view invoices, payments, proposals and files; upload files; read and send client chat; and create and update service items.
The page is specific about the controls. Authentication uses OAuth 2.1 with PKCE, each connection is bound to one firm account, and every tool call is audited and rate limited. On writes, the page says: “Your assistant prompts before any change. Deletes aren’t available at all.”
Advertisement
I think those are good defaults, and I would like to see other finance-software vendors copy them. Leaving out deletes removes the one action that cannot be reversed from inside the product.
The risk the page names itself
The same page carries a warning that I read as the most useful paragraph on it. It says: “AI assistants act on the content they read.” It then tells users to “treat anything your assistant summarizes as unverified until you check it in Financial Cents, and review actions before approving them, especially anything financial.”
That is a description of prompt injection, and it applies to this feature set directly. The assistant can read client chat and uploaded files. Those are inputs written by people outside the firm. The same assistant can also send a client message and upload files to a client’s project. A document a client uploads can carry instructions, and the assistant that reads it holds a permission that reaches the client’s inbox.
My position is that read access to outside content and permission to send to outside parties should be separate switches in any finance MCP server, granted by a named administrator, and off by default. A firm can then turn on “what’s overdue this week” for every bookkeeper without turning on client messaging for all of them. The product page I read describes the connection as governed by the user’s existing permissions, and it does not describe a separate control for client messaging. If one exists, the vendor should say so on that page.
The counter-argument
The strongest objection is that the confirmation prompt already covers this. The page says the assistant prompts before any change, so a human approves every message before it goes out. A firm that reviews each prompt is protected.
I accept that, and I still think it leaves a gap. A confirmation prompt shows the person what the assistant is about to do. It does not show them why. If an instruction hidden in a client document caused the draft, the prompt looks like any other routine reminder, and a tax preparer who approves thirty of them in a busy afternoon has little reason to read the thirty-first closely. The vendor’s own advice to review actions before approving them puts the whole burden on that reader. A permission set at the account level takes the decision away from the reader in the exact moments when attention runs out.
What this means for firms buying these tools
Agent tools in payments have raised the same issue. A guest essay on this site argued that when software is the customer, every bug is a bill, and a column argued that agent shopping needs a refund rule. The accounting back office is the next place it lands, with client communication in place of card payments.
Before connecting an assistant to a practice management system, a firm should get three answers from the vendor. Read access and send access should be grantable separately. The audit log should be exportable by client. An administrator should be able to turn off client messaging while leaving reads on. A vendor that can confirm all three has done the work. One that offers the confirmation prompt alone has shipped the first layer of protection and left the second to the customer.
Financial Cents deserves credit for putting the prompt-injection warning in public. The next step is a client-messaging permission that a firm can leave off.
Source: Financial Cents
