A separate identity for each company
Register an agent in the intended business. A runtime can connect selected companies, each with its own agent and grants. Permissions are not pooled across companies.
Accounting with agents. Authority with you.
Let agents do the work. Keep control and see what happened.
Unfair CPA lets authorized agents work on your company’s books through API and MCP tools. You choose their permissions and autonomy, then inspect supported requests and the accounting changes they produced.
Access is invite-based. The request form lets you ask for access or a demo; it does not create an account.
Your company. Your authority.
What can an agent do?
Only what its current permissions allow. You still define the assignment.
Grant the work you intend
Choose specific scopes and expiry. Read or draft access does not grant posting authority. The server checks current access when an operation executes, even if the client cached its tool list.
Decide how far it can go
Posting, approval, reversal, recording payments and other sensitive actions require explicit autonomy permissions. You can revoke access. Your tool’s own confirmation policies still apply.
Revocation blocks future request acceptance; already accepted work may finish. Check its outcome. Payment tools record payments already made or received—they do not transfer funds.
Evidence you can inspect
What happened—and under whose authority?
Current human company owners with verified MFA can inspect Agent activity history. Request evidence and accounting changes answer different questions.
Request history
Inspect the actor, company, operation, start and completion timestamps, outcome and linked record-change events for supported API/MCP requests. MCP exchange references help investigate protocol outcomes separately.
A linked execution summary is not proof of a before/after snapshot for every affected table. Browser, background and external activity have separate coverage limits.
Recorded permissions
Where a snapshot exists, inspect the roles, granted and required scopes, autonomy and expiry recorded when the execution-time scope gate passed. Later grant changes do not rewrite that evidence.
Passing that gate is not a successful accounting outcome. Early refusals, rollback and older paths can lack snapshots; this is not a complete policy trace.
Redacted before and after
Compatible linked staged-transaction events show selected recorded values, including date, amount, status and category IDs. See what changed without reconstructing the source document.
Description, counterparty, external import ID and unlisted values are excluded. Other events may show metadata only. Older records are not backfilled.
These are recorded operations and outcomes, not an external agent’s private reasoning. Audit evidence helps investigation; it does not guarantee correct accounting or provide cryptographic tamper-proofing.
The standard agent workflow
From assignment to a reconciled result.
Use this sequence for a new job, and resume from confirmed checkpoints when work is interrupted.
Discover
Find the correct company UUID, agent identity and current permissions. Names alone are not enough.
Confirm
Confirm the assignment, source material and allowed actions. A broad grant does not expand the job.
Inspect
Read existing records and check source IDs before writing. Account for pagination and prior work.
Execute
Work within authority. Keep one stable retry identity and identical payload for each intended write.
Checkpoint
Save confirmed results, original retry keys and record IDs in a private, durable job checkpoint.
Reconcile
Compare expected records with actual outcomes. Investigate missing, conflicting or unresolved results.
Report
Return company and record IDs, audit references, drafts versus posted work, and exceptions.
A practical example
Did the retry create another transaction?
An agent stages a synthetic $125.00 expense for Acme Studio. The first request succeeds, but the response is lost. Retrying the same write with the same key and payload returns the original record.
That is a second request attempt, not a second business change. A new operation—such as categorizing that transaction—needs its own retry identity.
What if the request is unresolved?
A missing completion is not proof that nothing happened. Inspect the original company, source identity and record before resuming. Compare exact source IDs and values, keep the original retry key, and report any mismatch.
Do not use a fresh key to force uncertain work through. Separate tool calls are separate transactions; a partially completed job needs reconciliation.
One transaction. Two requests.
- Company
- Acme Studio · company A
- Actor
- Acme bookkeeping agent
- Assignment
- Stage a $125.00 expense for review
- Authority
- Read + stage · no posting grant
- 10:00:00 → 10:00:01 UTCSucceeded
transactions.stagecreates record TX-001. Request REQ-001 links to change EVT-001. - 10:00:05 → 10:00:06 UTCReplayed
Identical payload + original retry key returns TX-001. Request REQ-002 adds no new transaction change.
Recorded staged-transaction values
- Before
- No record
- After
- −$125.00 · pending
Description, counterparty and external import ID are excluded from these value snapshots. Other record types may show metadata only.
Fictional company, times and shortened IDs. The agent stages a record; it has not posted an expense or moved money.
Correct the books. Retain the history.
How do you correct a mistake?
Use the correction path for the record’s current state and your permissions. A history panel is evidence, not an undo button.
Edit or delete a draft
Supported drafts, such as unissued invoices, can be edited or deleted through authorized application controls. Draft journal entries can be voided. Recorded audit history remains; not every draft has a full before/after view.
Void through the record’s workflow
Issued invoices and recorded payments have their own correction rules. Use the appropriate authorized workflow so both the document and its accounting stay aligned.
Reverse a posted entry
Posted journal entries are not edited in place. An authorized reversal creates a correcting entry and keeps the original. Period and accounting rules still apply.
Application controls and MCP tools have different coverage. Do not reverse a journal linked to a bill, invoice or payment as a shortcut for correcting that record. If the coordinated correction is not exposed to the agent, hand it to an authorized person with the record IDs and exception.
Connection guide · no signup required to read
How do Codex and Claude connect?
Unfair CPA supports private Streamable HTTP MCP connections at https://app.unfaircpa.com/api/mcp. Connecting a client does not expand its authority.
Prepare a bounded connection
- Choose the company and job. The owner registers a company-specific agent and chooses scopes, autonomy and expiry in Settings → Agents or Agent runtimes.
- Configure the client securely. Supply its owner-issued scoped credential from an approved secret store. Never put tokens in prompts, URLs or committed files. Selected-company runtimes need explicit company selection; OAuth connections remain single-company.
- Discover before doing work. Run
unfaircpa_discover, verify the company UUID and current grants, and load the returned instructions. The public agent API contract documents operations; live MCP discovery provides the tool schemas for your connection. - Validate with synthetic records. Test an allowed read, an authorized write, its identical retry, a refused operation and revocation in an isolated company. Record client/version, outcomes and IDs before authorizing real work.
Common questions
What should I know before delegating?
Does the agent need approval for every action?
You set its assignment and current scopes. Explicit autonomy grants can permit sensitive operations, while the client’s confirmation rules still apply. Read or draft access alone cannot authorize posting.
Is every action and every changed field captured?
No. Supported API/MCP request history links to recorded events. Redacted value inspection currently covers compatible staged-transaction events; other events can be metadata-only. Browser, background and external activity have separate gaps, and agent reasoning is not captured.
Does “unresolved” mean the request failed?
No. Its completion is unknown. Reconcile the original company and records before retrying, retain the original write identity, and report uncertainty rather than assuming success or no effect.
Can an agent access the owner’s audit-history screen?
The owner-history interface requires a current human company owner with verified MFA. Agents should report the attempt references returned to them; an audit reference does not grant access to owner history.
Do companion skills guarantee accurate books?
No. Skills guide a workflow; server controls enforce supported permissions and accounting constraints. Neither replaces appropriate review, reconciliation or investigation of exceptions. Real client acceptance must be verified separately.
Put a defined job in motion
Let the agent work. Keep the evidence within reach.
Request invite-based access to discuss your company and workflow. The form lets you request access or a demo.