Before an AI Agent Handles Client Data: 7 Security Checks for CPA Firms

CPA firms are moving beyond using AI for simple drafting and summarization.

AI is beginning to take a more active role in accounting workflows.

AICPA & CIMA's October 12, 2026 webcast on autonomous accounting workflows describes the shift from systems that simply exchange information to systems that can act on a firm's behalf. At the same time, the October Journal of Accountancy is urging firms to put AI agents and automations through governance and change-management processes, limit their access to sensitive information, apply least-privilege permissions, monitor activity, and require human approval for higher-risk actions. Review the AICPA & CIMA webcast and read the Journal of Accountancy guidance.

For CPA firms, that creates a practical question:

Before an AI agent gets access to client information, what should the firm verify first?

A good starting point is seven security checks:

1. What client data can the AI access?
2. Does it have only the permissions it needs?
3. What systems and APIs can it connect to?
4. How does the AI vendor handle client information?
5. What actions can the agent perform?
6. Where is human approval required?
7. Can the firm monitor and document what the agent did?

Those questions turn AI governance from a policy exercise into a security review.

What Is an AI Agent in a CPA Firm?

An AI agent is an AI-enabled system that can do more than respond to a single prompt.

Depending on the product and configuration, an AI agent may be able to:

• Retrieve information
• Analyze documents or data
• Interact with another application
• Complete several workflow steps
• Use an API or connected tool
• Create or update information
• Trigger another process
• Request human approval before continuing

Not every AI agent has all of these capabilities.

That is why CPA firms should evaluate the specific system and use case rather than treating every AI tool as though it presents the same risk.

An AI assistant that helps an employee rewrite an internal email is very different from an agent that can access client financial records and update another business system.

Why Should CPA Firms Review AI Agents Before They Access Client Data?

CPA firms should review AI agents before granting client-data access because the agent may be able to retrieve sensitive information, interact with other systems, use credentials, and perform actions on the firm's behalf.

The October Journal of Accountancy guidance recommends that AI deployments be tracked and reviewed through a governance model and that access to sensitive data be limited unless the use has been approved with appropriate safeguards. It also identifies least privilege, restricted API permissions, credential controls, AI-agent monitoring, and human approval for higher-risk actions as important guardrails. Read the October guidance.

That makes client-data access a deliberate security decision.

Not just a feature that gets turned on.

Security Check 1: What Client Data Can the AI Access?

Start with visibility.

Before approving an AI agent, determine what information it can actually reach.

Depending on the firm's services and systems, that may include:

• Taxpayer information
• Tax returns
• Client financial statements
• Payroll information
• Banking information
• General ledger data
• Workpapers
• Audit documentation
• Client communications
• Microsoft 365 files
• SharePoint or OneDrive content
• CRM records
• Accounting applications
• Internal firm documents

The question is not simply:

"Can this AI connect to our system?"

It is:

"Which information becomes available once we connect it?"

That distinction matters.

An AI agent that needs access to one controlled set of records should not automatically receive access to every client folder or business system.

AvTek's AI Governance Services are built around that broader question: which AI applications are approved, what information they may access, which business systems they can connect to, and who is responsible for oversight.

Does Existing User Access Affect What the AI Can See?

It can.

Some AI tools operate within the permissions already granted to the user.

That means an access-control issue that existed before AI can become more important once AI makes information easier to retrieve.

For example:

An employee may still have access to an old client folder.

Before AI, they may never browse back to it.

Once AI can search across information available to that user, the old permission may become much easier to surface.

That makes permission review part of AI readiness.

AvTek's guide to 7 Questions Every Business Should Answer Before Expanding Its Use of AI discusses the importance of understanding sensitive data, existing permissions, approved AI applications, and the safeguards around them.

Security Check 2: Does the AI Agent Have Only the Permissions It Needs?

This is the principle of least privilege.

Least privilege means giving a user, system, or AI agent only the access required to perform its approved function.

The October Journal of Accountancy guidance specifically recommends least-privilege access for AI agents. Read the guidance.

For example:

An AI workflow helping with appointment scheduling probably does not need access to client tax files.

An agent that summarizes one set of workpapers may not need access to every client repository.

An AI assistant that organizes internal administrative work may not need access to financial records.

The firm should ask:

• Which folders can the agent access?
• Which applications can it reach?
• Which client records are included?
• Does it need read access only?
• Does it need write access?
• Does it inherit broader permissions than the use case requires?

A useful rule is:

The AI agent should earn its access based on the business purpose.

Security Check 3: What Systems, APIs, and Credentials Can the AI Use?

AI agents often become more useful when they connect to other systems.

That also makes the security review more important.

The Journal of Accountancy specifically recommends restricting tool and API permissions and applying credential and data-access controls around AI agents. Read the article.

CPA firms should understand:

• Which applications the AI can connect to
• Which APIs it can use
• Which credentials support those connections
• What permissions those credentials provide
• Whether credentials are shared
• How credentials are protected
• How access can be revoked
• Whether another vendor is introduced through the integration

An AI tool may appear limited when viewed by itself.

Its authority can change significantly once it is connected to accounting software, Microsoft 365, client repositories, or other applications.

Read Access and Write Access Are Different Risk Decisions

One of the most important distinctions is whether the agent can only retrieve information or can change something.

Read access may allow the AI to:

• Search
• Retrieve
• Summarize
• Analyze

Write or action permissions may allow it to:

• Create records
• Modify information
• Send communications
• Update another system
• Trigger a workflow
• Delete information

Those are different levels of authority.

The firm should know exactly which one it is approving.

Security Check 4: How Does the AI Vendor Handle Client Information?

Internal permissions are only part of the review.

The firm also needs to understand what happens after information reaches the AI vendor.

Questions should include:

• Is client information retained?
• How long is it retained?
• Is it used for model training?
• Can training be disabled?
• Which subprocessors are involved?
• Where is the information processed?
• What administrative controls are available?
• Can firm data be deleted?
• What happens when the relationship ends?
• How does the vendor communicate security incidents?

Those answers should come from the vendor's current terms, security documentation, and product-specific policies.

Do not assume that two AI tools with similar features handle information in the same way.

AI Vendors Should Still Go Through Vendor Risk Review

AI is new technology.

Vendor risk is not a new concept.

If an AI vendor can access sensitive client information, the firm should evaluate that relationship like other important technology providers.

For firms subject to the FTC Safeguards Rule, the FTC requires covered financial institutions to take steps to ensure service providers safeguard customer information. The FTC specifically identifies tax preparation firms among examples of businesses that may fall under the Rule. Review the FTC Safeguards Rule.

Whether a particular CPA firm is covered depends on its activities and the Rule's definitions.

But the practical principle is broader:

An AI vendor should not bypass the firm's normal vendor-security review simply because the product is innovative.

For firms that need additional cybersecurity leadership around vendor decisions, AvTek's vCISO Services include cybersecurity risk assessments, governance, vendor and third-party risk discussions, policy development, remediation planning, and executive guidance.

Security Check 5: What Can the AI Agent Actually Do?

Access is one decision.

Authority is another.

A firm should understand whether an AI agent can:

Read information

Create information

Modify information

Send information

Delete information

Trigger another process

Call another application

Perform an action without asking first

That distinction becomes especially important when AI moves into accounting workflows.

AICPA & CIMA's current programming around autonomous workflows describes AI systems that can participate more actively in routine accounting processes rather than merely provide suggestions. Review the October 12 webcast.

The more authority the agent receives, the more important it becomes to define boundaries.

Security Check 6: Where Is Human Approval Required?

Not every AI action needs the same level of human review.

The Journal of Accountancy recommends human approval requirements for higher-risk AI-agent actions. Read the October guidance.

For a CPA firm, human approval may be particularly important before an AI agent:

• Modifies client information
• Makes an accounting entry
• Sends external communication
• Alters tax-related data
• Changes workpapers
• Produces a client deliverable
• Performs an action with financial consequences
• Updates a sensitive system

The exact approval point should reflect the workflow.

The important question is:

Which actions can the AI complete on its own, and which ones require a professional to approve the next step?

That decision should happen before the agent moves into production.

Human Review Should Be Designed Into the Workflow

"Someone will check it" is not a strong control if nobody knows exactly where that review happens.

A better process defines:

• Who reviews
• What they review
• When review occurs
• What happens if the result is incorrect
• Whether the AI can continue without approval

Human oversight works best when it is part of the process, not an assumption made afterward.

Security Check 7: Can the Firm Monitor and Document What the AI Did?

The final check is visibility.

If an AI agent accesses several systems or completes multiple steps, the firm should know what records are available afterward.

Depending on the technology, useful logs may include:

• Which user initiated the workflow
• Which AI agent performed the activity
• What information was accessed
• Which applications were involved
• What action was taken
• When the activity occurred
• Whether human approval was requested
• Whether anything was blocked
• Whether an error occurred

The Journal of Accountancy specifically identifies AI-agent activity monitoring as an important safeguard. Read the guidance.

Monitoring helps answer more than cybersecurity questions.

It can help the firm determine:

• Whether the agent is working as intended
• Whether employees are using it appropriately
• Whether permissions remain appropriate
• Whether a workflow needs to be changed
• What happened if something goes wrong

Client Data, AI Agents, and the Firm's WISP

For tax professionals, AI governance should connect to the firm's broader information-security program.

The IRS reiterated in 2026 that tax professionals must maintain a Written Information Security Plan, or WISP, designed around the size, scope, complexity, and sensitivity of the customer information the practice handles.

The IRS says a WISP should address:

• Employee training and management
• Information systems
• Identification and assessment of risks
• Safeguards
• Monitoring and testing
• Service-provider security

The IRS also recommends regularly reviewing and updating the plan as the business and its risks change. Read the IRS's 2026 WISP guidance.

That makes AI agents relevant to the WISP conversation when they change:

• How client information is accessed
• Which vendors process it
• Which applications connect to it
• Which credentials are involved
• What workflows are automated
• How activity is monitored

The AI policy and WISP are not the same document.

But they should support the same security objectives.

Should AI Agents Be Included in a CPA Firm's WISP?

If an AI agent affects how sensitive client information is accessed, processed, transmitted, or protected, the firm should consider the technology within its broader information-security risk analysis and security program.

That does not necessarily mean adding a section titled "AI Agents" to every WISP.

It means the WISP should reflect the technology environment the firm actually operates.

The IRS specifically tells tax professionals to keep their WISP updated as relevant circumstances and business complexity change. (irs.gov)

A new AI workflow with client-data access can be one of those relevant changes.

What About Employee-Built AI Automations?

This deserves special attention.

AI increasingly allows employees to build workflows and automations without traditional software development.

That can create useful innovation.

It can also create shadow IT if the automation becomes part of the firm's operation without formal review.

The October Journal of Accountancy article specifically warns that user-created AI agents and automations may need more rigorous review as their complexity and impact grow. (journalofaccountancy.com)

Consider this progression:

An employee builds an AI workflow.

It saves them time.

Another employee starts using it.

Then an entire team adopts it.

Eventually, it is connected to client information.

At what point did the firm decide the workflow was safe enough for production?

That is why AvTek's previous guide to AI governance and change management for CPA firms emphasizes moving from informal experimentation toward defined ownership, approved tools, data protections, and ongoing review.

The goal is not to eliminate experimentation.

It is to give useful experiments a safe path into normal operations.

What Should Happen Before an AI Agent Goes Into Production?

A practical approval process could look like this:

Step 1: Define the Use Case

What business problem is the AI agent solving?

Step 2: Identify the Owner

Who is responsible for the workflow?

Step 3: Map the Client Data

What information can the agent access?

Step 4: Review Permissions

Does it have only the access it needs?

Step 5: Review Systems and Credentials

What applications, APIs, and authentication methods are involved?

Step 6: Review the Vendor

How does the provider handle firm and client information?

Step 7: Define Authority

What can the agent read, create, modify, send, or trigger?

Step 8: Establish Human Approval

Which actions require review?

Step 9: Test the Workflow

Does it behave as expected?

Step 10: Enable Monitoring

Can the firm determine what happened afterward?

Step 11: Document Approval

Who approved the deployment and under what conditions?

Step 12: Define Review Triggers

What changes require another security review?

That process gives the firm a repeatable way to move AI from experimentation into controlled production use.

AI Security Should Connect to the Rest of the Firm's Technology Environment

AI does not operate in isolation.

An AI agent may depend on:

• Microsoft 365
• Identity systems
• Cloud services
• Endpoints
• Client portals
• Accounting applications
• Network security
• Credentials
• Vendor integrations

That means existing cybersecurity controls still matter.

AvTek's Managed IT Services support professional-services firms with cybersecurity and risk management, Microsoft 365 and Azure management, backup and disaster recovery, infrastructure management, and strategic IT planning.

For firms with internal IT teams, AvTek's Co-Managed IT Services can provide additional capabilities around Microsoft 365 security, Privileged Access Management, MFA, endpoint management, managed detection and response, data protection, and security monitoring.

The objective is not to bolt security onto the AI agent after deployment.

It is to make sure the surrounding environment supports the controls the firm expects.

What Are the 7 Security Checks Before an AI Agent Handles Client Data?

For a quick review, ask these seven questions:

1. What client data can it access?

Identify the exact information available to the AI agent.

2. Does it have only the access it needs?

Apply least-privilege permissions.

3. What systems, APIs, and credentials can it use?

Understand the complete integration environment.

4. How does the AI vendor handle client information?

Review retention, training, subprocessors, security controls, and incident procedures.

5. What actions can the agent perform?

Separate read access from create, modify, send, delete, and automated action permissions.

6. Where is human approval required?

Define when a professional must review the work before the process continues.

7. Can the firm monitor what the agent did?

Make sure meaningful logging and activity records are available.

If the firm cannot answer one of those questions, that is a useful signal that the deployment may need additional review.

Frequently Asked Questions About AI Agents and Client Data for CPA Firms

Before AI Gets the Client Data, Make It Earn the Access

AI agents may create meaningful opportunities for CPA firms to automate routine work.

The accounting profession is already exploring increasingly autonomous workflows, and current cybersecurity guidance is simultaneously emphasizing least privilege, governance, monitoring, and human approval.

Those developments belong in the same conversation.

Before an AI agent handles client information, a CPA firm should know:

What can it see?

What can it do?

What systems can it reach?

What credentials does it use?

How does the vendor handle the data?

Where does a person approve the next step?

Can we see what happened afterward?

Those are not anti-AI questions.

They are the questions that make responsible AI adoption easier to sustain.

AvTek Solutions helps CPA and professional-services firms connect AI adoption with cybersecurity, compliance, and business risk through AI Governance Services, Compliance Services, Managed IT Services, Co-Managed IT Services, and vCISO Services.

If your firm is preparing to let AI agents interact with client data or business systems, this is a good time to review the permissions, vendor controls, human approvals, and monitoring around those workflows before they become part of everyday operations.

Talk with AvTek about AI governance and cybersecurity for your CPA firm