Default every AI agent connected to Xero to read-only. Grant write access only for a named, narrow set of actions. Put a human approval step between the agent drafting a change and that change posting to your books. That decision got a lot more concrete on September 22, 2026. Meridian, a product built inside the accounting-automation company Pilot, launched a free connector that lets Claude, ChatGPT, Cowork, and Codex work directly in Xero. The connector can create and modify real Xero records, journal entries, invoices, bills, payments, purchases, and transfers, not just read reports (Meridian, via GlobeNewswire, September 2026). The permission toggle between read-only and read-write now sits inside a free tool any Xero user can turn on. This guide is about what should sit on the other side of that toggle before you do.
Key Takeaways- Read-only access lets an AI agent read the Xero data its connection is scoped to and analyze it, nothing more. Read-write access lets it create or modify real financial records: invoices, bills, payments, journal entries.- Meridian's free Xero connector (launched September 22, 2026) sets read-only or read-write per connected company. In its own words, it is "intentionally a lightweight connector" that "does not provide shared access, workflow management, review, or an end-to-end close process" (Meridian's launch announcement, September 2026).- Insight: The permission toggle gets set once, at setup, by whoever is in a hurry to get the agent working. The review gate is the part nobody configures under time pressure, which is exactly why it needs to be a deliberate decision, not a default left on read-write because that was the fastest way to unblock the demo.- AWS's guidance on AI agent access to cloud resources recommends defaulting to read-only and scoping any write permission narrowly to a specific resource (AWS Security Blog, April 14, 2026). A separate AWS post on agentic AI security principles says a human should approve or reject any agent action that could modify high-value data, initiate a financial transaction, or send sensitive information externally (AWS Security Blog, April 2, 2026).- 46% of developers say they distrust the accuracy of AI-generated output (Stack Overflow Developer Survey, 2025), which is the honest starting point for deciding what an agent gets to touch unsupervised.
Key Takeaways
- Read-only access lets an AI agent read the Xero data its connection is scoped to and analyze it, nothing more. Read-write access lets it create or modify real financial records: invoices, bills, payments, journal entries.
- Meridian's free Xero connector (launched September 22, 2026) sets read-only or read-write per connected company. In its own words, it is "intentionally a lightweight connector" that "does not provide shared access, workflow management, review, or an end-to-end close process" (Meridian's launch announcement, September 2026).
- Insight: The permission toggle gets set once, at setup, by whoever is in a hurry to get the agent working. The review gate is the part nobody configures under time pressure, which is exactly why it needs to be a deliberate decision, not a default left on read-write because that was the fastest way to unblock the demo.
- AWS's guidance on AI agent access to cloud resources recommends defaulting to read-only and scoping any write permission narrowly to a specific resource (AWS Security Blog, April 14, 2026). A separate AWS post on agentic AI security principles says a human should approve or reject any agent action that could modify high-value data, initiate a financial transaction, or send sensitive information externally (AWS Security Blog, April 2, 2026).
- 46% of developers say they distrust the accuracy of AI-generated output (Stack Overflow Developer Survey, 2025), which is the honest starting point for deciding what an agent gets to touch unsupervised.
It matters because giving an AI agent write access to your books just stopped being a custom integration project and became a free toggle. Meridian's Xero connector, built inside Pilot, connects Claude, ChatGPT, Cowork, or Codex to a Xero account and lets the agent run reports, inspect individual transactions, and create or modify journal entries, invoices, bills, payments, purchases, and transfers. It also works with customers, vendors, accounts, items, attachments, and other Xero objects (Meridian's GlobeNewswire release, September 2026). Each connected company gets its own read-only or read-write setting.
What the connector does not include matters just as much as what it does. In Meridian's own words: "this is intentionally a lightweight connector. Only one connector user can access a given client company; it does not provide shared access, workflow management, review, or an end-to-end close process" (Meridian, via GlobeNewswire, September 22, 2026). Independent coverage of the launch adds that Meridian's own guidance to users is to "review a manual journal before it posts" (Superpower Daily, September 2026). The permission switch exists. The judgment about what should require a human to look at it first does not come built in. That is now the business owner's decision to make, whether they know it or not.
Read-only means the agent can read whatever data is available through its connection to the connected Xero company, and change none of it. It can pull a report, flag an anomaly, draft a suggested entry, or explain why a number moved, but every output stops at a suggestion. Read-write means the agent can act directly on the books it's connected to: post the invoice, record the payment, create the journal entry, no draft step required unless you build one in.
The practical risk gap between the two is not abstract. A read-only agent that hallucinates a wrong number produces a wrong report you can catch before anyone acts on it. A read-write agent that hallucinates a wrong number posts it to your general ledger, where it sits until a reconciliation happens to catch the discrepancy. The same 46% of developers who say they distrust AI output accuracy (Stack Overflow Developer Survey, 2025) are describing exactly this gap: the model is useful, and it is also wrong often enough that where its output lands matters.
Any task where the value is in the analysis, not the action, per the table above. That maps directly onto the AI Back Office role: document extraction, quotes, and reconciliation handoff are naturally agent-drafts-human-decides work, the same pattern behind back office AI agents going mainstream this year. The agent reads, counts, and drafts. A person decides whether what it found should become real.
Only narrow, defined, reviewable actions, the read-write rows in the table above, justify write access. AWS's guidance on agent access to cloud resources makes the same case for any system, not just accounting: default to read-only, and scope any write permission to the specific resource and action needed (AWS Security Blog, April 14, 2026). A separate AWS post on agentic AI security principles puts the approval gate itself in concrete terms: when an agent's action "could modify high-value production data, initiate financial transactions, or communicate sensitive information externally, a human makes the final decision. The agent recommends, and a human approves or rejects" (AWS Security Blog, April 2, 2026). Xero-specific or not, that is the right shape for a finance workflow: the agent proposes the write, a human approves it, and only the approval triggers the post.
The gate is two decisions made in writing before the agent runs, not a setting you toggle once. First, the spec: what exactly is this agent allowed to touch, under what conditions, and what counts as an exception that stops and waits for a person. Second, the approval point: before anything with a real dollar amount or a customer-facing consequence posts, a person reviews that specific action, not just the agent's general competence. That is the same two-gate structure behind every role we build: a locked written spec agreed before anything runs, and a human checkpoint on the output before it goes live. We wrote about why that second gate is non-negotiable for any AI agent, not just an accounting one, in why your AI agents need a human guardrail.
The same way, on whichever lane fits your team. In the managed lane, we connect to your Xero, or equivalent, with scoped, read-only-by-default access. We build the specific write actions your back office actually needs on a written spec you approve first, and we run the review gate ourselves. You get the code and the data either way, and the exit is clean with no lock-in if you ever want to take the connection in-house. In the embedded lane, we embed AI engineers inside your existing engineering team: an engineer from our bench builds the same access model in your stack, directed and reviewed by your own team.
Two honest limitations, stated plainly because this is a financial-data question and they belong here, not buried in a footer: we are not SOC 2 certified and not ISO 27001 certified, and references are available on request. If your compliance requirements demand a certified vendor, say so in the intake and we will tell you if we are the wrong fit before you waste a call finding out. We cover the broader version of this question, budget is rarely the real blocker, in why secure deployment, not budget, blocks SMB AI adoption.
For a narrow, spec'd set of actions with a human approval step in front of anything material, yes. For blanket write access with no review layer, which is what a default connector setup gives you, no. The risk is not that the agent is malicious. It is that it will confidently post a wrong number at the same speed it posts a right one, and nothing stops it unless you built something to.
Start read-only. Let the agent draft invoices, flag overdue ones, and extract bill data into a queue. Add write access only for the specific, repeatable actions you have watched it get right consistently, and keep a human checkpoint on anything above a threshold you set.
We use whatever integration path fits the client's existing stack, Xero included, but the connector is never the whole answer. The review layer, the written spec defining what the agent can touch, and the approval gate before a write action posts are the part we build around any connector. That is exactly the layer Meridian itself says its connector does not include (Meridian's own release, September 2026).
If the mistake happens before the approval gate, a human catches it before it posts and nothing changes in your books. That is the point of the gate. If write access was granted without one, the mistake is now a real entry in a real ledger, and there's no undo button: the change has to be reviewed and corrected through the client's own Xero controls. The right correction depends on the transaction, and an authorized person, an accountant on the client's side, is the one who determines it. This is the exact scenario the gate exists to prevent, not to clean up after.
No, if you use the managed lane: we set up the connection, the scoped permissions, and the review gate, and you approve the spec and the exceptions. If you already have engineering capacity, the embedded lane puts an AI engineer inside your team to build the same model in your own systems.
Any Xero user can turn on write access for an AI agent today, for free. Whether that is a good idea for your business depends entirely on which tasks you are willing to let an agent act on directly and what stands between a draft and a posted entry. If you want that decision made deliberately instead of defaulted, send a written intake describing what you'd want an AI Back Office role to touch in your books. The proposal that comes back will say exactly what's read-only, what's read-write, and where the gate sits.
Internal links to add from older posts within a week: back-office-ai-agents-going-mainstream (anchor: "AI back office agents"), secure-deployment-is-the-real-ai-barrier-not-budget (anchor: "secure deployment"), how-to-automate-back-office-without-it-team (anchor: "automate back office without an IT team").
Maxpertise is an AI-native engineering company. We embed native AI engineers inside your team, live in about 10 days. Please enable JavaScript to view the site, or email contact@maxpertise.net.