DeepLedgerFor a person who only needs reports, start with QuickBooks Online's report-access role. For an AI assistant, inspect the connector's permissions separately. A person being unable to edit an invoice does not prove that an authorized app is unable to create one.
This guide uses US QuickBooks Online terminology. Role names and availability depend on your plan and country. Check the permissions displayed in your own account before inviting someone.
Choose access for the actual job
| Job | What to inspect | What not to assume |
|---|---|---|
| A colleague needs financial reports | View company reports or reports-only role | Access to reports includes every underlying transaction or audit record |
| A bookkeeper needs to correct transactions | A suitable working role with the required permissions | An accountant invitation is read-only |
| An AI assistant needs to explain a report | Connector credential, available tools and enforced restrictions | A “do not change anything” prompt removes write access |
| Someone needs a single report once | Export the report and share it through your approved process | A permanent connection is necessary |
Intuit's role documentation describes the capabilities of each role. A standard user limited to customers or vendors can still have transaction permissions. “Limited” is not another name for read-only.
Give a person report access
Intuit's support instructions for report access identify View company reports for Plus and Advanced. Its role reference calls the role View reports and lists its restrictions. If the option is absent, check your subscription and current role list instead of assigning broader access to get around it.
- Sign in as someone allowed to manage users, and confirm the company.
- Open Settings → Manage users → Add user.
- Enter the person's details and select the report-access role offered in your account.
- Review the permissions shown, then send the invitation.
- Have the person sign in with their own account and verify the reports they need.
The current invitation flow is documented in Intuit's user-management guide. Do not share an administrator login to avoid an invitation or plan restriction.
Intuit says the View reports role excludes reports showing payroll or contact information, cannot open the underlying transactions and cannot access the audit log. Confirm whether that meets the recipient's needs. If they need only a dated P&L, a carefully reviewed export may be sufficient. The export still contains business information and needs an appropriate sharing method.
Check an AI connection separately
A useful first request is:
Confirm the connected company. Retrieve its profit and loss for September 1 through September 30, 2026, on the accrual basis. Show the dates, basis and totals returned. Do not create, update, send, void or delete anything.
That is a scoped instruction, not a technical permission. Before relying on a connection as read-only, establish which layer refuses writes: the server, the credential's access policy or a supported client restriction. Hiding a tool from one conversation does not establish what the same credential could do elsewhere.
Keep a short access record:
| Field | What to record |
|---|---|
| Company | Name and verified company identifier |
| Person or connection | Named user, client and credential type, never the secret value |
| Purpose | The reports or records needed |
| Restriction | Where write access is actually blocked |
| Verification | Who checked it, when, and the observed result |
| Off switch | The user or app authorization to revoke |
If you test whether writes are refused, use an authorized test company. Do not attempt a real-company write merely to see whether a permission works.
Using DeepLedger for the first report
DeepLedger can expose both reading and recording tools. Connecting it is not a promise that every tool is read-only, and task-based review is not a universal approval barrier for every supported write.
Start with the Claude setup guide or ChatGPT setup guide, verify the company, and compare one report with QuickBooks. If your organization requires enforced read-only access, verify the control available to your role and credential before connecting a live company. Do not infer permission from a successful report request alone.
If you later need changes recorded, use the write-access checklist to review company scope, authorization, duplicate checks and read-back verification.
Remove the access you actually granted
Removing a human user, revoking an AI-client credential and disconnecting an app are different actions. Identify which connection is in use and verify that new requests through it stop after revocation. Ending a chat is not the same as revoking its access.
Revocation does not reverse earlier transactions or erase reports already exported into another system. Review stored copies and previous changes separately.
Frequently asked questions
Can I give someone read-only access to QuickBooks Online?
For report access, check the View company reports or reports-only role available on eligible QuickBooks plans. It has limits and is not a general view-only version of every QuickBooks screen. AI connector access is a separate permission decision.
Does asking an AI not to write make its connection read-only?
No. A prompt describes your instruction. An enforced permission must refuse write requests even if the AI attempts one. Check the client, connector and credential actually in use.
Does a reports-only user control a connected app's permissions?
Do not assume it does. Review who authorized the app, the credential it uses and the restrictions the connector enforces. A human user's role and an app connection are separate things to inspect.