How Accounting Firms Can Build Personalized AI Infrastructure

AI for accounting firms works best as a small set of defined roles, not one general assistant. Each role, such as collecting client documents or drafting answers to routine client questions, gets its own memory, tools and permissions, plus a named person who approves anything that leaves the firm or changes a record. Personalized AI infrastructure is what keeps those pieces together and under the firm's control.

Key takeaways

• Start from recurring workflows, not from a tool. Map each workflow to a role with a clear job, inputs, outputs and an owner.
• Separate drafting from sending and proposing from writing. Agents can prepare work freely, but external messages and ledger changes need a human approval point.
• Give every role the least access it needs, and keep client data isolated so one engagement never leaks into another.
• Define success in observable terms before you build: what finished work looks like, and what evidence the agent must attach.
• Treat the setup as operated infrastructure. Connections expire, rules change and instructions drift, so someone must own maintenance.

What does personalized AI infrastructure mean for an accounting firm?

Most firms first meet AI as a chat window. Someone pastes in a question, gets an answer and pastes it somewhere else. That is useful for individuals, but it does not remember the firm's way of working, it cannot act in the practice management system, and nobody can say afterward what it saw or did.

Personalized infrastructure is the opposite arrangement. An agent has its own identity and accounts, a memory of the firm's procedures and each client's context, a defined set of tools, permissions that match its role, and logs that a partner or operations lead can read. The human stays in control of what the agent can touch and what it may do without asking.

For an accounting firm this matters more than for most businesses, because the work is built on confidentiality, accuracy and professional responsibility. A fast answer that is wrong, or sent to the wrong client, costs more than a slow answer. Infrastructure is how you get speed without giving up that discipline. If you want the wider picture first, the journal's explanation of the layers of company AI infrastructure is a good companion to this article.

Which recurring workflows map to which agent roles?

The useful exercise is to list the work your firm repeats every week and ask what the smallest reliable role would be for each. A role is not a personality. It is a job description with boundaries. Here is a practical mapping.

• Document collection role: Tracks which documents each client owes for a given engagement, sends reminders drafted in the firm's tone, checks incoming files against the request list, and flags what is missing, unreadable or duplicated. It does not decide whether a document is sufficient for filing.
• Client questions role: Drafts replies to routine questions such as deadlines, what the firm needs, or the status of a request, using only the client's file and the firm's approved guidance. It escalates anything that sounds like advice, a dispute or an emotional situation.
• Bookkeeping preparation role: Reads bank and ledger exports, proposes categorizations and flags unusual items with the evidence behind each suggestion. It proposes entries; it does not post them.
• Deadline and status role: Maintains a view of what is due, what is blocked and who is waiting on whom, and prepares the weekly status summary for the team.
• Review preparation role: Assembles a working paper pack for a reviewer, lists open questions and notes where figures differ from the prior period, so the reviewer starts with the questions rather than the gathering.
• Onboarding role: Collects engagement details from a new client, prepares the checklist and drafts the welcome message for a person to approve.

Notice what these roles share. Each has a narrow purpose, a specific set of sources and a clear output. Whether they run as separate agents or as one agent with distinct task modes is a design choice, and the article on single-agent versus multi-agent systems explains when splitting is worth it. For most firms the first answer is to begin with one role and keep the others as later phases.

Where should approval points sit?

Approval points are not a sign of distrust in the technology. They are how you define what the agent is allowed to own. A useful rule is to place a human checkpoint wherever an action is hard to undo, visible to a client, or tied to professional judgment.

Use this decision guide for each step in a workflow.

• Reading and summarizing internal material: No approval needed, but log what was read.
• Drafting an internal note, checklist or working paper: No approval needed before drafting. The preparer reviews it as part of normal work.
• Sending a reminder that follows an approved template to a client: Approval can be relaxed after a trial period, with sampling by a team member.
• Sending any message that answers a substantive question, mentions figures or interprets a rule: Approval required every time.
• Proposing a change to the ledger, a client record or a tax position: The agent writes the proposal with evidence. A qualified person approves, then the change is made.
• Filing, payment, or anything submitted to an authority: Outside the agent's permissions. A person performs it.

Two habits keep approvals meaningful. First, show the approver the evidence, not only the draft: the source document, the extracted figure and the rule or procedure the agent relied on. Second, make rejection cheap and informative, so that corrections feed back into the instructions rather than disappearing. The pattern of proposing a change before writing it is explored in the article on AI CRM updates with human review, and the same logic applies to ledgers.

What memory, tools and permissions does each role need?

Three questions shape the design of any role: what must it remember, what can it do, and what must it never reach.

Memory comes in two kinds. Firm-level memory holds procedures, templates, tone guidelines, escalation rules and the checklist for each engagement type. Client-level memory holds the engagement scope, the client's preferences, prior requests and decisions that were already made. Keep these separate. Firm procedures should be written in documents with a clear owner and a review date, so the agent does not rely on an outdated rule. Client memory should be stored per client and retrieved only for that client's work. The client data isolation checklist covers the controls worth checking.

Tools are the actions the agent can take: read a mailbox folder, list files in a client's folder, query the practice management system, create a draft, post a comment on a task. Each tool should have a clear contract for its inputs and outputs, and write tools should be separate from read tools so you can grant them independently.

Permissions follow the role. The document collection role needs to read an inbox folder and a client's folder, and to create drafts. It does not need access to payroll or to the general ledger. Consider giving the agent its own accounts rather than borrowing a staff member's login, a point developed in the article on why a company agent needs its own identity and accounts. That way its actions are attributable, and you can revoke access without disrupting a colleague.

One risk is specific to this profession: client documents and emails are untrusted input. A PDF or an email can contain text that tries to instruct the agent. Design for this by keeping instructions separate from content, limiting what tools a role can call after reading external material, and requiring approval for sensitive actions. Authorization guidance and prompt injection prevention guidance from OWASP are both worth reading before you finalize permissions.

What does this look like in practice? An illustrative scenario

This scenario is illustrative, not a description of a real firm or result.

Imagine a small firm that prepares annual returns for self-employed clients. Every year the same pattern appears: the team sends a request list, clients reply in pieces over several weeks, and a staff member spends time checking the inbox, matching attachments to the list and writing follow-ups.

The firm defines a document collection role. Its task contract says: for each active engagement, maintain the list of expected documents, match incoming attachments to list items, and prepare a follow-up draft for any client with missing items. Its tools are read access to one shared inbox folder, read and write access to a designated intake folder per client, and permission to create task comments and email drafts. It cannot send email.

When a client sends three attachments, the agent files them in that client's intake folder, marks two list items as received, notes that the third file is a photograph that is too blurry to read, and drafts a short message asking for a clearer copy. The preparer sees the draft, the matched list and the reason for the flag, edits one sentence and sends it. When a client replies with a question about whether a certain expense counts, the agent does not answer. It tags the thread as needing a professional and summarizes the question for the preparer.

The success criterion is observable: by a set date, every active engagement shows a complete list or a documented reason for each missing item, and every outgoing message was approved by a named person. The firm can check this without trusting anyone's impression of how things went.

How should a firm get started, step by step?

The aim of a first engagement is one useful role that works reliably, not a firm-wide transformation. The advice in choosing a first AI workflow that is small enough to prove applies directly. Here is a plan.

• Step one: Pick one workflow that repeats often, has a clear definition of finished, and carries limited risk if a draft is wrong. Document collection for one engagement type is a common candidate.
• Step two: Write the task contract. State the inputs, the allowed tools, the output format, the escalation conditions and the evidence required. The guide on writing an AI task contract your team can test shows how to make it testable.
• Step three: Prepare the sources. Gather the procedures, templates and checklists the role will use, and name an owner for each. Remove outdated versions so the agent does not retrieve them.
• Step four: Set up identity and access. Create the agent's own accounts, grant the minimum permissions, and separate read from write.
• Step five: Define approval points using the decision guide above, and decide who approves in each case, including who covers absences.
• Step six: Test with real but past examples. Build a small set of cases with known good outcomes, including awkward ones such as blurry scans, duplicate files and ambiguous questions.
• Step seven: Run in a supervised phase where every output is reviewed, and record corrections.
• Step eight: Relax approvals only where the record supports it, and keep sampling.
• Step nine: Review on a schedule. Check permissions, expired connections, template changes and any drift in the quality of drafts.

Skipping the last step is the most common failure. Rules change, staff leave, and integrations break quietly. Someone has to own the running system.

How does Be Human's managed approach handle this?

Be Human designs, implements and operates personalized AI infrastructure for companies. A first engagement for an accounting firm would define one useful role, the memory and tools it needs, the approval boundaries and an observable success criterion. Managed operations can then include monitoring, recurring evaluations, integration maintenance, permission review, incident response and controlled improvements, with the firm keeping control of what the agent can access and do. Service is remote, in English and Portuguese.

Frequently asked questions

Which accounting tasks are safest to automate first? Start with preparation tasks that produce drafts or checklists for a person to review, such as tracking missing documents or assembling a working paper pack. These have a clear definition of finished and a low cost if the first draft is imperfect. Avoid starting with anything that sends advice to clients or touches filings.

Is it safe to give an AI agent access to client data? It can be, if access is deliberate. Give the agent its own account, limit it to the folders and systems its role needs, keep each client's data isolated, and log what it reads and does. Review the provider's security practices before you sign, and keep sensitive actions behind human approval.

Will an AI agent replace staff accountants? The more realistic effect is a change in where staff time goes. Gathering, matching and chasing shrink as preparation work, while judgment, review and client conversations stay with qualified people. The approval points in the design exist precisely so that professional responsibility remains with the humans who hold it.

How do we know whether the agent is working well? Define the evidence before you start: what a finished task looks like, what the agent must attach, and what counts as an error. Test with past cases, review a sample of live outputs on a schedule, and track the rate of corrections by approvers. If you cannot observe the result, the role is not ready to run unsupervised.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.