Letting an AI near client files: the approval gate we built first

If you have ever watched an AI tool confidently rewrite something it should have asked about first, you already know the real question for a practice: not "can it do the work?" but "who signs off on the change?"

We build Fedix and MYLEDGER for Australian accountants, and we made that question the first design decision rather than the last. This post walks through the guardrails we think any AI assistant near client records should have, and how ours behave. It is general information about our software, not advice about your obligations.

1. Nothing changes until a person says so

The basic pattern is a gate. When the MYLEDGER Copilot or a connected assistant asks for a change, that change waits for a person to approve or reject it. The AI proposes; your team decides. [feature:acb-copilot-write-gating]

The same idea applies to Xero. Every change Fedix would make in Xero is confirmed by a person in a confirmation dialog first. [feature:crm-xero-write-confirm]

For an engineer, this is a boring design: a queue of pending changes and a human-held key. For an accountant, boring is the point. It means a draft stays a draft until someone with the right judgement looks at it.

2. The assistant acts as you, not as a super-user

A common shortcut in tool integrations is a shared service account with broad access. We went the other way. The FediPilot desktop assistant uses Fedix as the person who signed in, with the same permissions. [feature:crm-mcp-user-jwt]

So if a staff member cannot see a client's file, the assistant working on their behalf cannot either. There is no separate, wider permission set to audit.

Desktop actions are also tied to a specific device: AI actions from the desktop are tied to an enrolled device, and sensitive actions need approval. [feature:crm-mcp-fedix-desktop]

3. A first draft, not a finished return

The most common worry we hear is about tax returns. In Fedix, an AI assistant works through the client's documents and produces a first draft of the return preparation for an accountant to review. [feature:crm-tax-return-agent-prepare]

The word that matters there is "review". The draft is the start of your professional process, not a replacement for it.

4. Evidence of who did what

Approvals are only useful if you can show them later. In MYLEDGER, sensitive actions are recorded centrally, with categories and retention, as evidence of who did what. [feature:acb-audit-log]

When a client, a reviewer or your own quality process asks "who approved this and when?", the answer should be a record, not a recollection.

5. And if you still want to undo something

Gates reduce mistakes; they do not remove the need for a safety net. MYLEDGER lets you preview a plan to roll a client's ledger back to an earlier time, apply it, and undo it if needed. [feature:acb-restore-to-time]

A short checklist for any AI tool you evaluate

• Does a person approve changes before they land?
• Does it act with the signed-in user's permissions, or something broader?
• Is there a record of sensitive actions you can show a reviewer?
• Can you preview and reverse a bulk change?

These are the questions we would ask a vendor, including ourselves. You can read more about how we approach security on the Fedix site: https://home.fedix.ai/security?utm_source=devto&utm_medium=article&utm_campaign=cold-start-2026-10&utm_content=pub-fb0bb1110450

If you want to see the approach in practice, start at https://home.fedix.ai/?utm_source=devto&utm_medium=article&utm_campaign=cold-start-2026-10&utm_content=pub-fb0bb1110450.