Management decides who uses an AI assistant

An AI assistant connected to SynkriaOps acts in your books. So it is management that decides, not each colleague. Until the company administrator has authorised anything, no colleague can connect an assistant, even with the Accountant or CFO role.

By the end of this page, you will know how to open the AI assistant to your team, give each person a precise profile, and what happens when you change your mind.

In short: four locks

A colleague can only use an AI assistant once all four locks are open, in this order:

Lock	Who controls it	By default
1. Machine access is open on the account	SynkriaOps support, at your request	Closed
2. Management authorises this colleague	The company administrator	Nobody but the administrator
3. This colleague’s profile (tier and custom actions)	The company administrator	Read only
4. The boxes ticked by the colleague when connecting their assistant	The colleague, within their profile	Nothing ticked beyond the chosen level

On every call, SynkriaOps also checks the person’s role in the company and the subscription. An assistant never holds more than its owner, nor more than the profile management has given them.

By default, nobody but you

As long as you change nothing, the setting is “Only you”: the administrator can connect an assistant, colleagues cannot. A colleague who tries is stopped on the authorisation screen with this message:

Only the company’s super administrator can connect an AI assistant. Ask them to do it, or to give you that ability.

In Settings → AI assistants and MCP, they read: “Only the company’s super administrator can connect an AI assistant. You keep the list of your own accesses and can delete them.”

This is deliberate: opening the AI assistant to the team is a management decision, taken knowingly.

Open the AI assistant to your team

The setting is in Settings → AI assistants and MCP (Connectivity group), block “Who can connect an assistant?”. Only the administrator sees it.

Setting	Effect	When to choose it
Only you (default)	No colleague can connect an assistant.	You are testing the assistant yourself before opening it.
People you choose	Only the colleagues you assign a tier to. The others stay on “Not authorised”.	The most common case: you open it to two or three trusted people.
All colleagues	Everyone can connect their assistant with the default tier, or the one you assign them.	A large, trained team where everyone works with an assistant.

Excluding a single person

With “All colleagues”, every person gets at least the default tier: there is no option to exclude one. To keep someone out, choose “People you choose” and assign a tier to each of the others.

1. Open Settings → AI assistants and MCP.
2. In “Who can connect an assistant?”, choose “People you choose” (or “All colleagues”).
3. SynkriaOps asks you to confirm your identity: this is expected, the setting commits the company.
4. In the “Colleagues” list, choose the tier of each person concerned (see below).
5. If needed, open “Custom actions” under a colleague to grant rights on top of their tier.

The colleague can then connect their assistant by following Connect an assistant.

Who can be authorised

Only the CFO, Accountant and Auditor roles appear in the list. The Reader role (a file’s client) can never connect an assistant, whatever the setting. The administrator can always connect one, within their own rights.

Each colleague’s assistant profile

A colleague’s profile is the maximum their assistant can do. It is made of a tier and, if you wish, custom actions.

Tiers

For each colleague in the list, a menu offers:

Choice	What the assistant can do
Not authorised	Nothing. The colleague cannot connect an assistant. (Offered with “People you choose”.)
Default tier	The tier chosen for the whole team. (Offered with “All colleagues”.)
Read only	Look up: general ledger, trial balance, vouchers, bank, bank accounts, supplier invoices, reminders, third parties, matching, chart of accounts, VAT, journals, fiscal years. Nothing is changed.
Accounting assistant	Everything read only allows, plus preparing: create and edit draft vouchers, record and edit supplier invoices, create and edit third parties, suggest how to assign a bank transaction, prepare reminders. The colleague keeps final approval.

No tier allows posting, sending, paying or matching. These actions are granted one by one, to a specific person.

Custom actions

Under each colleague, “Custom actions” lists the rights you can add to this person only, on top of their tier. Actions marked sensitive durably change your books or write to your customers:

Area	Sensitive actions
Accounting vouchers	Post a voucher, send an invoice, reverse a voucher
Supplier invoices	Approve (post), pay
Matching and bank	Match, unmatch, match or unmatch a bank transaction, reverse a transaction
Reminders	Send a reminder
Third parties	Change a customer’s email address
Recurring invoices	Generate, stop, archive

For a read-only colleague, the list also offers the preparation rights of the “Accounting assistant” tier, one by one: you can, for example, let them create third parties without opening vouchers to them.

Example profiles

Person	Suggested profile	Why
Accountant trying the assistant for the first time	Read only	They ask questions about the figures; nothing is changed.
Accountant in charge of data entry	Accounting assistant	The assistant prepares vouchers and supplier invoices; the accountant posts them.
Chief accountant	Accounting assistant + “Post a voucher” and “Match”	They also delegate posting and matching, under their responsibility.
Collections officer	Read only + reminder preparation + “Send a reminder”	The assistant follows unpaid invoices and sends reminders, without touching entries.
Auditor	Read only	They review without being able to change anything.

Booby-trapped documents

An assistant that reads documents written by others (supplier invoices, PDFs, bank labels) may find hidden instructions in them. For these uses, keep paying, sending and posting out of the profile. See Security and best practices.

What happens when a colleague connects their assistant

1. The colleague pastes the MCP server address into their assistant (Claude or another compatible client). The assistant opens their browser on SynkriaOps.
2. They sign in to SynkriaOps with their own account. Their password never leaves SynkriaOps.
3. SynkriaOps checks that management has authorised them. If not, the connection stops there.
4. The authorisation screen only offers what their profile allows. An action management has not granted them is not offered as grantable.
5. They choose the access level, optionally tick actions, then authorise. For a sensitive action, they must also tick the confirmation box.
6. The access appears in Settings → AI assistants and MCP, marked “authorised by” with their name. The administrator sees it too.

From then on, every action of the assistant is recorded in the access’s “Recent activity”: what it created, changed or looked up, and when. The authorisation screen is detailed in Authentication and permissions.

The calculation, on every call

What the assistant can actually do is recalculated on every call, never frozen at connection time. It is the smallest of five limits:

• the colleague’s role in the company;
• the company’s subscription;
• the profile given by management (tier and custom actions);
• the boxes ticked by the colleague at connection;
• where relevant, the branches chosen for this access.

Example: an accountant has the “Accounting assistant” profile and ticked “Post a voucher” at connection, back when management had granted it. If management removes that action from their profile, the assistant can no longer post, even though the box is still ticked on the access.

Changing your mind: effect within seconds

What management does	Effect on assistants already connected
Lowers a colleague’s tier	Their assistants lose the matching rights.
Removes a custom action	Their assistants can no longer perform it.
Sets a colleague to “Not authorised”	Their assistants stay connected but can no longer reach anything.
Goes back to “Only you”	All colleagues’ assistants stop acting.
Revokes a specific access	That access is refused from the next call, permanently.

The effect applies within a few seconds (fifteen at most), with nothing to revoke by hand. To cut an access permanently, the administrator revokes it: they see every access in the company, can filter by colleague and revoke other people’s accesses. The procedure is in Revoke an access.

Giving an authorisation back

If you give a colleague their tier back, their still-valid accesses regain their rights, within the new profile. To start from scratch, revoke the old accesses: they will create a new one.

Traceability

• Every settings change, and every authorisation granted, changed or withdrawn, requires the administrator to confirm their identity.
• Each is recorded in the company’s audit log, with the before and after state: who authorised whom, with which tier and which actions.
• The colleagues list shows how many active accesses each person has.

For an accounting firm

A firm has its own setting, in Firm settings → Machine access tab: managers only (default), the people the firm authorises, or all colleagues. An assistant’s rights on a client file remain capped by what the client company grants the firm. Details are in Authentication and permissions.

Frequently asked questions

Can an accountant connect an assistant without my knowing? No. Until you authorise them, the connection is refused. Once authorised, each of their accesses appears in your list, with their name.

Can I let a colleague look things up without changing anything? Yes: Read only tier, with no custom action.

Can I allow sending reminders but not posting vouchers? Yes. Sensitive actions are granted one by one, to a specific person.

What does the colleague see if I withdraw their authorisation? Their assistant stays plugged in, but every request fails for lack of rights. The colleague keeps the list of their accesses and can delete them.

Can the assistant exceed the colleague’s rights? No. Even with a generous tier, the assistant never does more than the colleague’s role allows in SynkriaOps.

See also

Authentication and permissions The authorisation screen block by block, access levels, validity and revocation.

Understanding roles and permissions Administrator, CFO, Accountant, Auditor, Reader: what each role allows in SynkriaOps.

Security and best practices Traceability, call limits, hidden instructions in documents, confidentiality.