AI agent security for accounting firms

An accounting AI agent should receive only the client data needed for one defined job. It should use firm-controlled accounts, narrow permissions, written retention rules, protected logs, and a tested shutdown path. Do not give it live taxpayer or client data until the firm can trace where that data goes and who can retrieve it.

Security here covers the whole workflow. A safe model connected to an overpowered service account can still expose or alter records. A secure portal can still pass a tax document to a model provider under unacceptable retention terms. Review the collection point, integrations, model, tools, logs, backups, and human handoff as one system.

Start with the rules that already apply

The FTC Safeguards Rule guide lists tax preparation firms among its examples of covered financial institutions. Covered firms must maintain a written information security program suited to their size, activities, and the sensitivity of the customer information they handle. The Rule addresses risk assessment, access controls, encryption, multi-factor authentication, service-provider oversight, testing, training, and incident response.

Coverage turns on a firm’s activities and jurisdiction, not the label “accounting firm.” The FTC guide is not a substitute for the Rule or legal advice. Firms should have a qualified adviser determine which requirements apply.

For tax practices, IRS Publication 4557 says tax return preparers must create and enact security plans to protect client data. Its checklist includes limiting access, encrypting sensitive files, using multi-factor authentication, maintaining activity logs, training staff, and responding to data loss.

The NIST Generative AI Profile is voluntary guidance rather than an accounting regulation. It adds AI-specific questions about privacy leakage, third-party services, secondary data use, model changes, testing, monitoring, and incident handling.

Map the data before granting access

Create a data-flow register for the actual production route. A vendor’s general security page cannot show what your configuration sends, stores, or logs.

Point in the workflow	Record before launch	Control decision
Collection	Document types, fields, client consent or instruction, source system	Reject files and fields the job does not require
Transfer	Destination, protocol, account owner, subprocessors	Approve encrypted routes and named services only
Processing	Model, retrieval store, prompt context, temporary files	Remove unnecessary identifiers and separate client workspaces
Action	Systems the agent can read or change	Allowlist tools, records, and permitted actions
Logging	Inputs, outputs, tool calls, approvals, errors	Store references when full content is unnecessary
Retention	Copy locations, backups, deletion process, legal holds	Set an owner, period, and verifiable deletion method

Follow one sample client file through every row. Include retries, failed runs, support access, exports, and backups. Those paths are easy to miss in a diagram limited to the successful case.

Set the vendor and account controls

Ask each model, hosting, monitoring, and integration provider for written answers that match the planned configuration:

• whether submitted data may be used to train or improve a provider’s models
• what the provider retains, for how long, and in which logs or backups
• which subprocessors receive data and where processing occurs
• how the provider encrypts data and authenticates administrators
• how the firm can export and delete its data when service ends
• how security incidents, material service changes, and model changes are reported
• which evidence the firm may review, such as independent assessments or test results

For a covered firm, the FTC guide says provider selection, contract safeguards, and ongoing oversight belong in the information security program. A contract clause does not remove the firm’s responsibility to check the service in operation.

Use a dedicated service account for the agent. Give it read access unless a write is necessary for the defined job. Restrict it to named folders, clients, fields, and API actions. Keep credential administration with a person outside the agent’s runtime. Require human approval for filing, posting, payment, deletion, client commitments, and permission changes.

Test those boundaries. Ask the agent to retrieve another client’s file, follow instructions hidden in an uploaded document, reveal a secret from its context, call an unapproved tool, and repeat a blocked action. A refusal in a chat window is not enough. Confirm that the identity and tool layers deny the action and create an alert.

Preserve the source and the action trace

An output should point back to the source record used, the transformation performed, and any human decision. Keep the original document separate from generated summaries. Do not let a summary silently replace source evidence.

For work under PCAOB standards, preserve more than the generated answer. PCAOB AS 1105 requires sufficient appropriate audit evidence. When auditors use information produced by the company, they must test its accuracy and completeness or test the relevant controls, then evaluate whether it is sufficiently precise and detailed. The standard also addresses the reliability of external electronic information. It does not approve or prohibit AI, and an AI-generated work item does not remove the auditor’s evidence duties.

Logs should be useful without becoming a second client-data archive. Record a case identifier, source references, system and prompt versions, tool calls, approvals, changes, exceptions, and result. Exclude passwords, tokens, and full documents unless a documented need requires them. Apply access and retention rules to the logs themselves.

Prepare for failure before production

Write a short response procedure for the agent. Name the person who can disable it, revoke its credentials, preserve relevant logs, notify the security lead, and move the work to a manual queue. Define triggers such as cross-client access, an unauthorized write, sensitive data in an output, unexplained bulk activity, or a provider incident.

Run the procedure once before launch. Confirm that disabling the agent stops its scheduled jobs and queued actions, not just new chat requests. The notification and reporting steps should come from the firm’s incident plan and applicable law. Do not improvise legal conclusions during an incident.

A prelaunch review

The owner should be able to answer yes to each item:

• The job has a written start, finish, allowed actions, and prohibited actions.
• The data-flow register includes every provider, store, log, backup, and support path.
• Vendor terms match the intended data, retention, deletion, and incident process.
• The service account has the smallest practical permission set.
• Tests cover cross-client access, malicious documents, unauthorized tools, and secret exposure.
• A person approves consequential actions and can inspect the supporting source.
• Monitoring detects unusual access, blocked actions, corrections, and provider changes.
• The firm has rehearsed shutdown, credential revocation, evidence preservation, and manual fallback.

The AI agency due-diligence checklist can support vendor review. The controlled autonomy guide shows how permissions and human checkpoints fit into workflow design.

Limitations

This article is a workflow security method, not legal, tax, audit, privacy, or cybersecurity advice. It does not determine whether a firm complies with the FTC Safeguards Rule or any state, professional, contractual, or client requirement. A checklist cannot replace a technical security assessment, penetration test, or incident-response exercise. Controls must be tested against the firm’s systems and revised when data, vendors, models, integrations, threats, or obligations change.

Sources and methodology

This method applies current federal and NIST guidance to an accounting AI workflow. NIST’s AI guidance is voluntary. PCAOB standards apply only within their stated scope. The sources do not provide a universal approval for sending accounting data to an AI service.

• FTC, Safeguards Rule: What Your Business Needs to Know
• IRS Publication 4557, Safeguarding Taxpayer Data
• NIST AI 600-1, Generative AI Profile
• PCAOB AS 1105, Audit Evidence