What can an AI agent do with
All business transactions (broad, being retired)?
This broad permission covers most of your day-to-day transactions in Xero: invoices, bills, quotes, purchase orders, credit notes, payments, bank transactions, receipts, and manual journals. The app can view and change them. Xero is splitting it into narrower permissions and will keep this one only until September 2027.
How to spot it
On a Xero connection or settings screen, this is accounting.transactions.
With it, an agent can
- Create and change sales invoices and bills, and create or delete repeating invoices.
- Email sales invoices to your customers from Xero.
- Record payments against invoices, and delete (reverse) payments.
- Create spend money and receive money transactions and bank transfers.
- Add or change manual journals.
- Create quotes, purchase orders, and credit notes.
- Delete draft invoices and void approved ones.
It cannot, on its own
- Delete an approved invoice. It can only void it.
- Edit a payment once it is recorded. It can only delete it and add a new one.
- See your financial reports. That is a separate permission.
What a bad day looks like
A tricked agent could email invoices with wrong amounts to your customers, sent in the name of the person who connected the app, and mark unpaid invoices as paid.
Set it up safer
- Ask the seller to use narrower permissions instead, such as accounting.invoices, or accounting.transactions.read if it only needs to look.
- Connect with a Xero user who has only the permissions the tool needs. Xero checks the connecting user's permissions for some actions, such as working with manual journals or changing a contact's bank details.
- Require your approval before it emails invoices or records payments.
Narrower permissions on Xero:
- All business transactions (view only, being retired)
accounting.transactions.read - Invoices and bills
accounting.invoices - Invoices and bills (view only)
accounting.invoices.read - Payments
accounting.payments - Bank transactions and transfers
accounting.banktransactions - Manual journals
accounting.manualjournals
Ask the company selling the agent
- Xero now offers narrower permissions. Why do you need the broad transactions one?
- Will your agent email invoices or record payments without my OK?
- What happens to your product when Xero retires this permission in September 2027?
Source
Checked against Xero documentation on 2026-09-28. All Xero permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.