--- title: "Bookkeeping and tax AI rules: data and approvals" description: "Set bookkeeping and tax AI rules for client records, provider review, professional approvals, recipient checks, and per-function spending controls" canonical: "https://scalewithsearch.com/articles/bookkeeping-tax-ai-data-approval-spend-rules" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # Bookkeeping and tax AI rules: data, approvals, and spend Write an AI permission sheet for each bookkeeping or tax function. Identify the client, entity, period, records, provider, reviewer, and permitted output. Keep authority to post, file, send, or move money outside an initial preparation function. Use this guide to assemble questions and proposed controls for the practice's qualified reviewers. Approval of a software account and approval of a particular disclosure are different decisions. Record both before using live client material. The [practice hub](/for/bookkeeping-and-tax-practices) describes administrative jobs. This guide defines the rules around those jobs, rather than choosing tax treatment or an accounting method. ## Determine which obligations apply to this practice Begin with the work performed and information handled. Do not classify the whole firm from its trading name. Keep pure bookkeeping assignments, tax preparation, payroll, and other services separately described in the review sheet. The FTC includes tax preparation firms in its Safeguards Rule examples. Its guidance calls for covered firms to maintain a written information-security program and oversee service providers. Coverage turns on activities and jurisdiction, with specified exceptions from some provisions. [FTC Safeguards Rule guidance](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know), checked 2026.10.26. Have the practice's responsible security reviewer determine the actual coverage and controls. Do not assume that every bookkeeper has identical obligations or that small size removes all requirements. Keep the approved determination and review owner in the security record. Check other professional and jurisdictional requirements for the assignments the practice accepts. The AI builder should receive the approved rules for the function. The builder should not make the practice's legal or professional determination from a broad prompt. ## Review tax-return information separately Treasury regulations restrict preparers' disclosure and use of tax-return information and define that information broadly. The rules also contain permitted uses and disclosures. [26 CFR 301.7216-1](https://www.ecfr.gov/current/title-26/section-301.7216-1) and [301.7216-2](https://www.ecfr.gov/current/title-26/section-301.7216-2), checked 2026.10.26. Where consent is required, the regulations impose conditions on it. Have a qualified reviewer determine the applicable permission for the specific recipient and purpose. [26 CFR 301.7216-3](https://www.ecfr.gov/current/title-26/section-301.7216-3), checked 2026.10.26. Do not use a general service agreement as your answer to every disclosure question. Record what the function reads, where it sends the content, who can access it, and why that use is permitted. Include support access, subcontractors, and processing locations in the provider review. If the permission remains unresolved, keep the function on synthetic examples. A useful administrative purpose does not settle the disclosure decision. Require the reviewer to approve the actual data path before production use. ## Give every record class a default rule Build the first function from the minimum approved inputs. Keep credentials and full document collections outside it unless the function's scope requires a separately reviewed connection. | Record class | Proposed first-function rule | Approval owner | | --- | --- | --- | | Public service descriptions | Read from approved practice copy | Practice owner | | Client and entity identifiers | Use scoped internal references where sufficient | Engagement owner | | Tax returns, organizers, and source documents | Hold pending specific data-use review | Responsible tax professional | | Bank and payroll material | Restrict to the approved assignment and workspace | Security and engagement owners | | Portal passwords and recovery codes | Exclude from prompts and receipts | Account owner | | Prior-year files | Read only when named for a reviewed purpose | Assigned professional | | Another client's records | Exclude | Practice owner | Use the table as a policy draft. Add the actual systems, permitted roles, and retention rules. Do not label an entire folder safe because one document in it was approved. Ask the maintainer to demonstrate that source permissions apply to attachments and retrieved results. Inspect generated summaries and error files as well as the successful output. Keep the scope visible in the resulting receipt. ## Enforce client, entity, and period together Require all three fields before a live job starts. Check them against the approved source register. Stop when the input set contains a conflicting entity or an unexplained period difference. Keep receipt status separate from professional acceptance. A document marked uploaded is not automatically usable. A reconciliation marked open must remain open until authorized staff change the controlling record. Do not let a model-generated note overwrite the ledger, organizer, or notice register. Save proposed corrections to a review queue. Have the responsible professional accept a correction before it changes future work. Test two fictional clients with matching surnames and two entities under one owner. Require the function to return only the permitted records. Searching everything and filtering the final answer is not the access boundary to accept. ## Bind approval to the exact effect For document requests, have the preparer approve the required list. Have the administrator verify recipient, approved channel, attachments, and final text. Keep a changed recipient or year from inheriting the earlier approval. For close packets, have the authorized close reviewer approve conclusions and any client-facing explanation. Keep transaction categorization, journal entries, reconciliation completion, and financial-statement release outside the preparation function. For notices, have the assigned professional verify authenticity, relevant deadlines, engagement scope, and response authority. The first function should assemble a packet. It should not answer the authority, admit liability, or choose a position. Keep bank transfers, payroll execution, refunds, signatures, and filing behind separate permissions. Ask the builder to prove that the first function lacks those capabilities. A written instruction to seek approval is not proof of enforcement. ## Keep collection and communication channels distinct Use the approved private document process for source material. Give a routine message only the information needed to explain the next administrative step. Avoid attaching a complete source bundle to a missing-document reminder. Use the [client portal page guide](/articles/tax-practice-website-client-portal-link) when briefing the public entry point. Verify the internal destination and access process separately. A link label on the website cannot establish the receiving system's permissions. Have the practice approve its incident route. Tell staff whom to notify if prohibited data enters an unapproved tool. Preserve the evidence needed for the responsible reviewer to decide the response. Do not let the model make that determination. ## Make professional review visible in the packet Require the review copy to name its assigned professional and show the unresolved questions first. Keep a preparer's accepted instruction separate from a client's explanation. The administrator should be able to identify which statement controls the next draft without asking the model to rank the people involved. If the assigned reviewer is absent, use the practice's approved cover arrangement. Hold the packet when no authorized substitute is named. Record the hold and its owner in the receipt so another staff member can find it. ## Cap spend without broadening access Give each function a monthly limit, per-run ceiling, retry allowance, and named alert recipient. Set the limits in the execution configuration. Check remaining allowance before another paid call. Do not respond to a budget failure by switching to an unreviewed service. Keep every replacement subject to the same data-use approval and acceptance cases. Name approved models in internal configuration so staff can identify what processed a job. Write a receipt containing the function, scoped client reference, source versions, model, outcome, and cost. Exclude tax identifiers and document contents unless the approved receipt process requires them. Keep cost reporting usable without exporting a private client register. ## Test the permission sheet before handoff Require fixtures for wrong client, wrong year, conflicting entity, forbidden attachment, changed recipient, attempted posting, and insufficient budget. Include a repeated job and an unavailable provider. Require a clear stopped or failed receipt rather than an invented completion. Have an authorized staff member reproduce a complete packet and find its sources. Save the acceptance record and runbook with the practice. The handoff is complete when staff can direct, check, and correct the function under the approved rules. Bring that permission sheet to Scale With Search. Read [AI systems](/ai-systems), then name the first preparation function through the [written scope form](/work). Continue the website review: [AI-native bookkeeping and tax practices: first functions to build](/articles/ai-native-bookkeeping-tax-first-functions); [Write a bookkeeping cleanup service page](/articles/bookkeeping-cleanup-service-website-page); [Bookkeeping for contractors: brief a useful service page](/articles/bookkeeping-contractor-niche-service-page); [Write a monthly bookkeeping service page](/articles/monthly-bookkeeping-service-page); [Tax practice inquiry forms: qualify the first conversation](/articles/tax-practice-new-client-inquiry-form); [Tax practice review requests: protect taxpayer details](/articles/tax-practice-review-requests-taxpayer-privacy); [Tax appointment booking: connect the website and calendar](/articles/tax-practice-website-appointment-booking-page); [Add a client portal link to your tax practice website](/articles/tax-practice-website-client-portal-link); [Tax practice website credentials: what to publish](/articles/tax-practice-website-credentials); [Keep tax deadlines current on your practice website](/articles/tax-practice-website-deadline-page-updates); [Tax preparation fees: what your website should explain](/articles/tax-practice-website-fees-page); [Can a virtual bookkeeper have a Google Business Profile?](/articles/virtual-bookkeeping-google-profile-eligibility). [bookkeeping and tax practices](/for/bookkeeping-and-tax-practices): website and search resources. ## Related: bookkeeping and tax practices - [Write a monthly bookkeeping service page](/articles/monthly-bookkeeping-service-page) - [Tax practice inquiry forms: qualify the first conversation](/articles/tax-practice-new-client-inquiry-form) - [Tax practice review requests: protect taxpayer details](/articles/tax-practice-review-requests-taxpayer-privacy) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```