A security researcher recently walked through how an AI agent inside a large tech company’s infrastructure ended up with access it should never have had. The details are specific to Hugging Face’s environment, but the pattern isn’t. An agent got assigned broad permissions because that was easier than scoping them narrowly. Nobody logged what it actually touched. When something went wrong, the incident response team spent days reconstructing what the agent had done, because there was no clean trail to follow.

Read that paragraph again and swap “tech company” for “accounting firm” and “infrastructure” for “your client ledgers.” That’s the version that should keep a managing partner up at night.

Most firms in the $1M-$25M range have started using AI tools somewhere in their workflow, whether that’s a bookkeeping assistant, a document extraction tool, or something built in-house. Very few have asked the question the Hugging Face incident forces on you: what exactly can this thing see, and can you prove it after the fact?

Your AI Tools Already Have More Access Than You Think

Here’s what typically happens when a firm adopts an AI tool. Someone on staff finds a promising product, connects it to the general ledger software or the document management system, and grants it whatever access level gets it working fastest. That’s usually admin-level or close to it, because scoping permissions down takes extra setup time and nobody budgets for that.

Six months later, that tool has read access to every client’s bank feeds, payroll data, and AR aging, plus write access to draft journal entries. Nobody remembers granting all of that. Nobody’s checked the permission list since onboarding. And if a client asks “who or what touched my payroll data last quarter,” most firms can’t answer with confidence.

This isn’t a hypothetical risk reserved for firms doing something exotic with AI. It’s the default state for firms doing something ordinary with AI, which describes most of the market right now. The tools got adopted for speed. The access controls never caught up.

We see this gap constantly in our work building agents for bookkeeping and accounting firms through Omni for operations. It’s one of the first things we address before an agent goes live, because a fast agent with unrestricted access isn’t a productivity win. It’s a liability sitting quietly in your stack until something forces you to notice it.

What Privileged Access Actually Means for an Accounting Firm

In IT security, “privileged access” describes any account or system that can see or change more than a normal user needs. A junior bookkeeper doesn’t need write access to every client’s chart of accounts. A partner doesn’t need to see raw bank feed credentials. The principle is simple: access should match the job, not the convenience of setup.

AI agents break this principle by default, because most agent platforms are built to request broad access upfront and figure out the specifics later. An agent doing month-end reconciliation might only need read access to bank and AP feeds for the clients it’s assigned to. Instead, it often gets read-write access to the entire general ledger system, across every client, because that’s the path of least resistance during implementation.

For an accounting firm, this matters more than almost any other business type. You’re not just protecting your own data. You’re the custodian of financial records for dozens or hundreds of clients, each with their own regulatory exposure, their own bank relationships, their own liability if something leaks or gets altered incorrectly. A misconfigured agent doesn’t just create an internal headache. It creates a client-facing trust problem, and those are expensive to repair.

The fix isn’t complicated in concept. It’s just rarely done. Every agent needs a defined scope, a specific list of what it can read and what it can change, tied to the specific clients and accounts it’s actually working on. That scope needs to be reviewed the same way you’d review a new employee’s system access, not set once and forgotten.

How We Build Agents With Access Controls Baked In

When we build an agent for a firm, access scoping isn’t an add-on step. It’s part of the design from day one.

Take our Month-End Close Agent, which pulls bank, AP, AR, and payroll feeds, reconciles them, flags variances, drafts journal entries, and prepares a partner-ready close pack. That agent needs meaningful access to move fast, no question. But it needs access to the specific client accounts it’s assigned to close, not blanket access to every client the firm has ever onboarded. We scope it client by client, and every action it takes gets logged with a timestamp, the account touched, and the specific change made.

That log matters more than most firms initially expect. If a partner asks “why did this journal entry get drafted this way,” the answer isn’t buried in someone’s memory of a Slack conversation from three weeks ago. It’s in the audit trail, readable in under a minute.

The Client Onboarding Agent works the same way. It collects documents from new clients through a guided workflow, sets up the chart of accounts, and produces a clean opening trial balance. During onboarding, this agent is handling sensitive historical financial data for a client who hasn’t fully trusted the firm yet. That’s exactly the moment where access scoping and logging matter most, because if something looks off in that opening trial balance six months later, you need to know precisely what the agent touched and when.

We take the same approach with the Advisory Insights Agent, which reads each client’s monthly numbers and drafts talking points before partner meetings. Even though this agent’s job is analysis rather than transaction-level work, it still touches sensitive numbers across every client on a partner’s book. Scoped access and a logged trail apply just as much here as they do to anything writing entries.

None of this is about slowing agents down. A well-scoped agent runs just as fast as a poorly-scoped one, day to day. The difference only shows up when something needs to be checked, reviewed, or defended, and at that point the difference is everything.

The Audit Trail Question Nobody Asks Until It’s Too Late

Here’s the uncomfortable truth about most AI adoption in accounting right now. Firms ask “can this tool do the work” and “how much time does it save.” Almost nobody asks “can I produce a complete record of everything this tool touched over the last twelve months,” until a client, a regulator, or an insurer asks first.

That question tends to arrive at the worst possible time. A client disputes a number during a bank loan application. An insurance carrier wants proof of internal controls before renewing a policy. A new partner joins the firm and wants to understand what’s actually running under the hood before putting their name on the work. In every one of these situations, “we’re pretty sure the AI tool didn’t touch anything it shouldn’t have” is not an answer that holds up.

Logging every agent action isn’t about distrust of the technology. It’s the same discipline you’d apply to a new staff member with system access, extended to a system that happens to move faster and touch more accounts per hour than any human could. The Hugging Face incident got attention because a security researcher went looking and found gaps that had been sitting there for months. Most firms using AI tools today have never gone looking. That’s the exposure, not the AI itself.

If you want a structured way to think through where your firm’s data controls stand right now, our guides section has practical breakdowns on setting up review workflows that don’t rely on catching problems after the fact.

What This Costs You If You Get It Wrong

Let’s put real numbers around this instead of leaving it abstract. A firm doing $5M in revenue with 20-30 clients typically has an AI tool or two touching financial data somewhere in the stack, often without a documented access policy behind it. If that access ever becomes a problem, the cost doesn’t show up as one clean invoice. It shows up as partner hours spent reconstructing what happened, as a client relationship that needs repair, and in the worst case, as a professional liability conversation nobody wants to have.

Compare that to the cost of scoping access correctly from the start, which is mostly a matter of design discipline rather than added spend. The Month-End Close Agent and Client Onboarding Agent we build for firms cost the same to run whether they’re scoped tightly or loosely. The only difference is whether you can answer the audit trail question when someone asks it.

This is also where the broader time math connects back to your bottom line. Firms lose 30-50% of staff capacity to the month-end and year-end crunch, time that could go toward the client conversations that actually build the relationship and the fee. Onboarding drag pushes 20-30% of new clients into a quarter of delayed billable work before they’ve even had a real advisory conversation. Advisory work itself bills at 2-3x the rate of compliance work, and it’s the first thing that gets crowded off the calendar when close season hits. Agents that free up that time only help if they’re trustworthy enough to run without a partner double-checking every output. Access control is what makes that trust possible.

If you want a concrete starting point for the month-end piece specifically, we put together a Month-End AI Close Map for Accounting Firms that walks through the close calendar, the friction points, and where an agent with proper controls fits into the process. It’s a practical worksheet, not a sales pitch, and it’s worth fifteen minutes if you’re staring down another close season without a clear plan for who or what is touching your clients’ books.

You can also find more context on how firms are approaching this shift in our insights library, where we cover the operational side of AI adoption in professional services firms without the hype.

Where to Start: The Omni Audit

None of this requires an overhaul of your tech stack or a six-month project plan. It requires an honest look at what’s currently running against your clients’ financial data, who set it up, and whether anyone could produce a clean answer if a client or a regulator asked about it tomorrow.

That’s exactly what an Omni Audit does. It’s a 60-minute session, no deck, no sales pitch buried inside it. We walk through your current workflows, map where AI tools or manual processes are touching sensitive client data, and hand you three concrete outputs: a list of where access is broader than it needs to be, a rough estimate of the hours and dollars tied up in your current close and onboarding process, and a specific recommendation on where an agent with proper scoping would help first.

If you’re running a firm in the $1M-$25M range and you’ve adopted any AI tool touching client financials without a documented access policy behind it, this is worth an hour of your time before your next close cycle, not after.

See Omni for accounting and bookkeeping for a closer look at how we approach this for firms your size, or go straight to Book a 60-min Omni Audit and we’ll get a session on the calendar this week.

The Hugging Face incident is a warning worth taking seriously, but it’s also an opportunity. Most of your competitors haven’t looked at their AI access controls yet either. Firms that get this right now, both the productivity gain from agents like the Month-End Close Agent and the discipline of scoped access and logged actions, will be the ones clients trust with more of their financial picture over time, not less.

If you want to see what this looks like specifically for a firm your size, before committing to anything, the AI audit for accounting and bookkeeping is the lowest-friction way to find out. You can also browse our blog for more detail on how individual agents like the Advisory Insights Agent get built and deployed, or explore Omni for advisory work if the crowded-out advisory conversation is the piece that’s costing you the most right now.

Either way, don’t wait for your version of the Hugging Face incident to find out what your AI tools have been quietly able to touch. Book my Omni Audit and get a clear answer in an hour instead of a scramble in a crisis.