What can an AI agent do with
Attachments on your records?
This lets the app view, download, upload, and replace files attached to your Xero records, like a receipt on a bill or a contract on a contact.
How to spot it
On a Xero connection or settings screen, this is accounting.attachments.
With it, an agent can
- Upload files to invoices, bills, bank transactions, contacts, manual journals, and other records.
- Replace a file already attached by uploading a new one with the same name.
- Show an attached file with an online invoice your customer sees.
- List and download files already attached.
It cannot, on its own
- Delete attachments. Xero offers no delete for attachments, though a new upload can replace an existing file.
What a bad day looks like
If misused, it could download private documents like receipts and contracts, or replace real receipts with misleading files.
Set it up safer
- Use accounting.attachments.read if it only needs to read receipts.
Ask the company selling the agent
- Which documents do you download, and where do you keep them?
- Will your agent attach or replace files on my records on its own?
Source
Checked against Xero documentation on 2026-09-28. All Xero permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.