EconomicoSecurity & permissions
Your agent, your token, your books.
Give the agent you already trust a controlled path to run finance — without handing an accounting vendor the keys to your email, CRM, bank, or files.
How do I give an AI agent access to my financial data safely?
Connect your agent through Economico's standard OAuth 2.1 flow. You sign in, see which agent client is asking, and explicitly allow it to access your business. The agent receives a bearer token for Economico's fixed finance surface, scoped to your business and role — not a broad credential to your computer or other cloud accounts.
Today, a founder connection uses the owner role, which can read
and run the available finance tools. That is intentionally powerful: only
connect an agent you trust to take those actions. If you are evaluating a new
agent or a workflow, start in Economico's disposable test scenario before
using your real books.
Economico does not connect to your email, CRM, bank, or files.
Your agent is the integration layer. If it can already read an invoice in your inbox or customer details in your CRM, it can use that context to record the relevant financial fact in Economico. Economico itself does not receive a standing connection to those systems, so there is no accounting vendor inside your stack holding their keys.
This keeps the boundary clear: your agent handles the systems you chose to connect to it; Economico handles the accounting record. It is not a bank, and it does not need your bank login to maintain your books.
What protects the connection?
The browser authorization flow uses OAuth 2.1 with PKCE. Authorization codes are one-time and short-lived; access tokens expire, and refresh tokens rotate on every use. The authorization server verifies the registered redirect URI, and every MCP request is checked against a signed access token before any tool is exposed.
The ledger also treats agent retries as a normal failure mode: repeated requests do not double-send an invoice or double-post a payment. That is a control against a flaky network or an agent retrying a request, not a reason to skip review of consequential instructions.
How do I stay in control?
Use the agent you already chose, approve only the client you recognize, and review the prompt before giving it a consequential instruction. For an automated or headless agent, register a dedicated OAuth client and signing key for that job; you can list and revoke registered clients when the work ends. Your business can also create a planning scenario to test a change without altering the real ledger.
Economico gives an authorized owner a finance operating surface, not a pretend read-only view. That is why the safest setup is a trusted agent, least-persistent connection practical for the job, and a test scenario for new workflows.
Connect deliberately
Keep the keys. Let your agent run the books.
Give your own agent one controlled connection to your accounting record — and keep every other system under your control.