Your AI Assistant Can Now Change Your Books. Three Locks Before You Let It.

October changed the question

For most of this year, the question about AI and your business data was simple: will it answer wrong? You connected an assistant to your documents, your price list, your inbox, and worried — reasonably — that it might quote last quarter's price or invent a policy you never wrote. That worry was justified, and it is still real. But in October 2026, a second question arrived, and it matters more: will it write wrong, and can you undo it?

• On October 13, 2026, Digits launched Write MCP, an update to its MCP server that lets customers' own AI agents create, update, and delete records in the general ledger — transactions, bills, invoices, and the chart of accounts — acting under the signed-in user's permissions, according to CPA Practice Advisor. Until then, the company's MCP server could only read.
• A week later, on October 20, 2026, Financial Cents launched its own MCP server, connecting a firm's practice-management account to Claude, ChatGPT, and Gemini so staff can ask plain-English questions — "What's overdue this week?", "Which invoices are still unpaid?" — and have the assistant take action, from logging time to creating tasks, according to Financial Cents and CPA Practice Advisor.
• These two launches followed an earlier wave: on February 24, 2026, Intuit and Anthropic announced that QuickBooks, TurboTax, Credit Karma, and Mailchimp would connect to Claude through MCP integrations, according to Intuit and Complete AI Training.
• And the pattern spread beyond accounting in the same month: ClicData launched its MCP server on October 21, 2026, connecting Claude, ChatGPT, and other assistants to the governed data a company already manages, according to GlobeNewswire and MCP Market, while Epic announced Connectors on the same day, which will let Epic find information and complete tasks in other apps, working with its AI assistants Emmie, Art, and Penny, with health systems able to review what each connector can read and change once developer-built connectors reach Showroom in March 2027, according to Epic and Healthcare IT News.

Here is the part that should change how you think about connectors. Digits did not just ship the power to write. It shipped a guardrail with it: Locked Periods. Once a period is locked, no person or agent can change it silently; proposed edits go to a review queue where an admin approves or rejects before anything posts, according to CPA Practice Advisor and Digits. Note the contrast the two vendors draw on deletes: Digits' write access includes delete capability, with locked periods protected by the review queue, while Financial Cents offers no deletes over its connector at all. Financial Cents shipped a different guardrail set: the assistant confirms before it makes any change, every action is audited and rate limited, access can be revoked in one click, the connection uses OAuth 2.1 so no password or API key is ever shared with the AI client, each connection is bound to a single firm account — and deletes are intentionally not available over MCP at all, according to Financial Cents and CPA Practice Advisor. Two serious vendors, shipping write access in the same month, each felt the need to bolt the doors before opening them. That is the signal: even the vendors building these connectors treat write access as something to gate, not to switch on casually.

The question is no longer only "will it answer wrong?" It is "will it write wrong — and can you undo it?"

Read wrong is embarrassing. Write wrong is expensive.

A wrong answer costs you a correction. A wrong ledger entry costs you a reconciliation, a restated report, and possibly a tax filing built on bad numbers. The difference is not the model's intelligence. It is the direction of the damage: read access can misinform one conversation; write access can corrupt the record every future conversation reads from.

The data underneath is the reason this matters now, not later. Ecommerce and catalog write-ups describe the same failure in customer-facing systems:

• duplicate SKUs and inconsistent formats across channels (in Zipchat's account) and inconsistent naming, missing attributes, and ambiguous variants (in RWIT's account) lead to wrong answers — confident wrong availability replies, and inaccurate filtering and suboptimal recommendations. Zipchat calls bad data quality the primary failure point for AI inventory answers.
• Inside the books, the same pattern holds: coding mistakes and duplicate entries distort the AI-generated insights built on them, because AI analyzes the books rather than auditing them, according to Campbell Tax and the Milford Times.
• The same omission logic shows up in AI shopping: agents evaluate structured signals — attribute completeness, pricing consistency across channels, inventory accuracy, identifier consistency — and, in the tested experiences reported, skip products whose data leaves a question open, omitting them rather than merely ranking them lower, according to ChannelKey and RevenueFlows.

Think about what that means once the assistant can write. A duplicate customer record does not just produce two different answers to "what does this customer owe?" It gives the agent two different targets to post a payment against, and it may pick the wrong one. A stale price does not just produce a wrong quote. If the agent can draft and update invoices, the stale price becomes a wrong invoice. A miscoded expense does not just skew a report. If the agent recategorizes transactions on its own, the miscoding can spread to every similar transaction it touches.

Put plainly as an inference, not a vendor claim: read access turns bad data into a bad answer; write access turns bad data into a bad record — and every later answer reads from that record.

That is why the vendors' guardrails are the real news. Locked periods, confirm-before-change, and delete limits are not just product features. They show that write access has to be gated until the mess is under control. Your business should take the same position, with the same three locks, before any agent gets write permission in any tool you use.

The three locks before write access

Lock one: lock closed periods

Close last quarter in your books, and make sure nothing — not you in a hurry, not your accountant, and certainly not an agent — can edit it except through a deliberate unlock or an approved review. Digits built this as Locked Periods, with a review queue for any proposed edit to a locked period. Your version does not need Digits. A period-close or lock-date setting is the feature to look for in your accounting tool; if yours does not have one, see the question on that in the FAQs below. The point is the rule, not the brand: the past is settled, and settled numbers do not change silently.

Lock two: confirm before every change

Nothing the agent does to your records should post without a human saying yes. Financial Cents made this the floor for its MCP: the assistant confirms before any change. Your version is a standing rule for however you use an agent: drafts first, and a posting only with your explicit approval. The agent prepares; you approve. If a tool cannot show you the change before it posts, that tool does not get write access yet.

Lock three: one master record

For each thing your business tracks — each customer, each product, each price — there is exactly one record that counts, and everything else points to it. Duplicates are not a filing problem. They are a targeting problem: an agent with write access and two records for the same customer may write to the wrong one. The cleanup in the next section is how you get there.

Two notes on that table. First, the vendor column is evidence, not endorsement — and the third row is your own master list, not a vendor feature. The first two rows are what the vendors chose to build, and they are worth copying as rules even if you never buy their products. Second, the three locks are a gate, not a project. You do not need perfect data to pass it. You need the locks in place before the first write, and a cleanup habit after.

The follow-along: a write-readiness cleanup for one small trading firm

Meet the example business. A small trading firm in Jaipur — call it Sharma Trading — sells packaging material to about 120 regular customers. It keeps a customer list in its billing software, a price list in a spreadsheet, and invoices in its accounting tool. The owner wants an AI assistant to draft invoices and chase overdue payments. Before any agent touches those records, the owner runs this cleanup. You can run the same one, in the same order, for your business.

Step 1: Pick your one master customer list

Open your billing software and export the customer list. Open every other place customer names live — the spreadsheet, the WhatsApp broadcast list, the old invoice file — and line them up. You are looking for one thing: the same customer under two names. "Verma Traders" and "Verma Traders Pvt Ltd" with the same phone number are one customer, not two. "Gupta Enterprises" in billing and "Gupta Ent." in the spreadsheet are one customer, not two.

Expected result: a single list where each customer appears exactly once, with one phone number and one GSTIN where applicable. Delete or merge the duplicates in the billing software, and point the other lists at it or stop using them. This list is now the master. If a tool cannot read from it, that tool does not get write access to customer records.

Step 2: Freeze one master price list

Open the price list spreadsheet. For each product, check three things:

1. the price
2. the unit (per kg, per pack, per piece)
3. the date it was last changed

Any row without a date is suspect — treat it as stale until someone confirms it. Any product with two different prices in two places gets one price, decided by you, written once, in the master list.

Expected result: one price list, dated, with one row per product and one price per row. Save it with today's date in the filename, and tell your team: this file is the price list; the old ones are archive.

Step 3: Close last quarter in the books

In your accounting tool, find the period-close or lock-date setting and close the last completed quarter. This is a bookkeeping step, not a connector feature, and it works in any tool that has one. Then test it: try to edit an invoice from last quarter. The tool should refuse, demand an unlock, or route the edit for review. If it lets you edit freely with no unlock and no review, your lock is not a lock — fix the setting before moving on.

Expected result: last quarter's numbers cannot change except through a deliberate unlock or an approved review. From here on, the agent — and everyone else — works only in the open period, except through a deliberate unlock or an approved review.

Step 4: Write the agent's first instruction by hand

Do not let the agent's first write be a real one. Write its instruction yourself, in plain language, and paste it into whatever assistant you use. Here is a starter prompt you can copy and adapt:

You are a drafting assistant for Sharma Trading, a packaging-material
trading firm. You may DRAFT invoices and payment reminders. You may
never post or send anything without my explicit approval. You may
never delete anything.

Rules:
1. Use ONLY the master customer list in the billing software. If a
   customer name matches two records, stop and ask me which one.
2. Use ONLY the master price list dated 2026-11-03. If a product has
   no price in that list, stop and ask me — never guess a price.
3. Never edit any record dated before 2026-10-01. Everything before
   that date is closed. If a task touches it, stop and tell me.
4. Show me every draft before it goes anywhere. A draft is not a
   posting, a posting without my approval is a failure, and a
   deletion is always a failure.

Your first task: draft a payment reminder for every invoice overdue
by more than 30 days, using the master customer list. List the drafts
here for my review. Do not send any of them.

Expected result: the assistant returns drafts for your review, stops at any duplicate or missing price, and refuses anything touching the closed quarter. If it posts or sends anything on its own, revoke its access and fix the instruction — that failure is the test working, not the test failing.

Step 5: Review the first ten drafts yourself

Take the first ten drafts the agent produces — payment reminders for overdue invoices — and check each one against the master lists by hand. Count how many needed a correction. If three or more needed one — three in ten, nearly a one-in-three error rate — your master lists are not ready yet: go back to steps 1 and 2 and find what the agent tripped on. That tripping is valuable. It is the cleanup telling you where the mess lives, before the mess reaches a customer or a filing.

Expected result: ten reviewed drafts, a short note of what needed fixing, and a decision: open the gate wider, or clean more first. Either answer is a good outcome. The bad outcome is skipping the review.

What to demand from any tool

You do not need to buy Digits or Financial Cents to use this post. Their launches are useful because they show what serious guardrails look like, and you can demand the same shape from whatever tool you already use. Ask these questions before granting write access:

• Can I lock closed periods, so nothing edits settled numbers silently? If the answer is no, the tool is not ready for write access, whatever else it promises.
• Does the assistant show me every change before it posts, and can I revoke its access in one step? Confirmation and revocation are the floor, not extras.
• Can the assistant delete records? If yes, ask why it needs to, and whether deletes can be switched off. Financial Cents chose to offer no deletes over its connector at all. That is a reasonable position to copy: drafts and updates, yes; deletes, no.
• Does it work from one governed source, or from whatever files it finds? ClicData's October launch grounded its assistants in a governed data layer rather than static uploads. Your small-business version of that layer is the master list from the cleanup above.
• Does it log every action it takes, so you can audit what changed and when? A write without an audit trail is a write you cannot explain later.

One honest limit, stated plainly: we have not verified whether the accounting tools commonly used by Indian small businesses — Tally, Zoho Books, Busy — offer equivalent MCP write connectors as of November 2026. Do not assume they do. The three locks do not depend on any vendor. They are rules for your business, and they apply to whatever tool you use, connector or not, the day you let an agent change a record.

The gate, not the goal

Write access is not a prize for having clean data. It is a door you open after the locks are in. Lock the past, confirm every change, keep one master record — and then let the agent earn wider access ten reviewed drafts at a time. The businesses that get hurt by write access will not be the ones that moved slowly. They will be the ones that connected first and cleaned later, and discovered the difference between a wrong answer and a wrong record the expensive way. The cleanup itself is part of our data readiness and integrations work: getting your business's data organized and connected so AI has something trustworthy to work with.