What can an AI agent do with
Customers and suppliers?
This lets the app view, add, and update your customers and suppliers in Xero, and archive them.
How to spot it
On a Xero connection or settings screen, this is accounting.contacts.
With it, an agent can
- Add new customers and suppliers.
- Update contact names, emails, addresses, and other details.
- Archive contacts you no longer use.
It cannot, on its own
- Add or change a contact's bank account details unless the person who connected the app has Xero's bank account admin permission.
- Attach files to a contact. That is accounting.attachments.
What a bad day looks like
A tricked agent could change a customer's email so invoices go to the wrong inbox, or change a supplier's bank details if the connecting user is allowed to.
Set it up safer
- Connect with a Xero user who does not have the bank account admin permission, so the app cannot change bank details.
- Use accounting.contacts.read if it only needs to look up contacts.
Ask the company selling the agent
- Will your agent change contact details without asking me?
- Could it ever change a supplier's bank details?
Source
Checked against Xero documentation on 2026-09-28. All Xero permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.