Read access is still access, so scope it. Grant the agent the entities, account ranges and periods its job needs, decide separately whether it sees balances only or journal lines and attachments, and exclude sensitive accounts unless the job requires them. Use the ledger's reporting interface, not direct database access. Every query is recorded with who asked and what came back.
What does read access involve, and who owns it?
The general ledger is the company's book of record: every account, every balance, and behind them every posted journal line. Read access lets an agent answer finance questions from authoritative figures, prepare reconciliations and drafts, and check other teams' work. It is the starting point for almost every finance agent.
It is also exposure. The ledger shows salaries in payroll accounts, legal provisions that reveal disputes, project codes for confidential deals and, for listed companies, results before they are published. An agent that can read all of it can disclose all of it to anyone who asks in the right way.
The financial controller owns ledger access and approves the agent's scope. The data protection owner cares about personal data in journal lines and attachments. The wider finance position is in AI agents for finance: books you can audit.
Which read permissions should you grant?
Even at depth 1, read access splits into separate capabilities:
| Read capability | Grant? | Condition | Stays with a person |
|---|---|---|---|
| Account balances by period | Yes | Entities and account ranges in scope | Nothing |
| Trial balance | Yes | Same | Nothing |
| Journal line detail | If the job needs it | Same, plus line-level masking where needed | Nothing |
| Journal attachments | Rarely | Named purposes only | Data protection owner approves |
| Posting user and approval history | If the job needs it | Same | Nothing |
| Payroll detail accounts | No, unless the job is payroll | Separate grant | Payroll team |
| Legal provision and confidential project accounts | No | Excluded by account range | Controller |
| Current open period before results are published | Case by case | Restricted users only | Controller |
| Any write, post or edit | No | Refused by your limits | Accountants |
Account ranges are the main tool. Most ledgers let you grant access by entity and range. Use them to exclude what the job does not need, rather than granting everything and asking the agent to stay away.
For a listed company, unpublished results are price-sensitive. If the agent can read the current period before publication, anyone who can query the agent can, in effect, too. Restrict that access to the finance users who already have it, and record every query.
How do you set it up, step by step?
- Person, process owner: describes the job. "Prepare bank and payroll reconciliations for the UK entities." The job defines the scope.
- Person, controller: approves the scope. Entities, account ranges, periods and detail level.
- Person, ledger administrator: creates a read-only integration user through the reporting interface, with that scope. Avoid direct database access: it bypasses the ledger's own security.
- Person: configures delegated queries where the agent answers questions for staff, so a person cannot see more through the agent than they could see directly.
- Agent, depth 1: runs the job. Attest checks it before it touches anything that matters; the testing approach is set out in how do you test an AI agent before it touches the general ledger.
- Person: reviews the scope at each access review and whenever the job changes.
What stays with a person?
Everything that changes the ledger, and every interpretation that leaves finance. The agent can say what a balance is; telling a lender, an investor or a regulator what it means is a person's job. Scope changes stay with the controller too. The agent cannot request a wider range for itself.
How is ledger data different from sub-ledger and warehouse data?
The ledger holds summaries; the detail often lives in sub-ledgers, such as payables, receivables and fixed assets. Reconciling the two is common agent work, as in reconciling payroll to the general ledger. The data warehouse holds copies of both, reshaped for analysis, with its own access model; see giving an AI agent read access to your data warehouse. For figures that will be relied on, the ledger is the source: it carries sealed provenance, while warehouse copies are derived and can be stale.
What is recorded for each query?
Every query is filed as a verdict: who asked, or which job ran it; the entities, accounts and periods; the level of detail; rows returned; and the bound that decided if anything was refused. Refused queries matter: a question that tried to reach an excluded account range shows either a job outgrowing its scope or someone using the agent to look where they should not.
The ledger's own access log should show the same queries under the integration user. If the volumes differ, something is querying the ledger outside the agent.
How do you revoke access?
Narrow the account ranges or entities on the integration user to reduce scope. Withdraw the capability in Pryme to stop the agent querying. Disable the user to stop everything. A certification run that clears no depth drops the agent to depth 1 the same day, which for a read-only agent does not change access; recertify promptly if the run exposed a problem with what it reads.
Where does it usually go wrong?
Read is treated as harmless. Scope is skipped because nothing can be changed. Then the agent answers a question about a colleague's salary.
Direct database access. Fast to set up, but it bypasses every security rule the ledger enforces.
Caches outlive access. The agent stores query results to answer faster, and those copies outlive a scope reduction. Set a short retention for cached ledger data.
Questions people ask
Does the agent need journal detail, or are balances enough?
For answering questions and checking trends, balances are often enough. Reconciliations and drafting need line detail. Grant detail only where the job needs it.
Can the agent read prior years?
If the job needs comparisons, yes. Closed periods carry less risk than the open one, though personal data in old lines still needs the same care.
Should the agent read the ledgers of all group entities?
Only the entities its job covers. Group-wide access is a separate grant with its own approval.