YOUR XERO ACCESS STILL APPLIES
KalkuleX never gives a user more access than Xero allows.
The same Xero permissions remain in control.
KalkuleX checks who the person is, which Xero company they selected and what their Xero role allows before releasing information. It can restrict access further, but it cannot give someone access that Xero has not granted.
See how access is governedXERO PERMISSIONS SET THE MAXIMUM
KalkuleX can restrict access further, but it cannot expand it.
KalkuleX reads the user's Xero role and applies it to the selected company. The same decision is checked again when work runs and when a result is exported.
If Xero says no, KalkuleX says no. If a permission is missing or unclear, access is denied rather than guessed. Security teams call this “failing closed”.
PROTECTED FROM THE FIRST SIGN-IN
Each person signs in with their own protected identity.
The production account design gives every person their own identity and requires an authenticator code in addition to a password. Lockout and session controls are designed to reduce the value of stolen or repeatedly guessed credentials.
Identity is confirmed before activation.
Password controls and lockout protection apply.
A second factor is required to complete sign-in.
Short-lived handoffs prevent reusable access links.
KX SUITE · FINER CONTROL
Xero defines what is possible. KX Suite can decide what this person may do.
KX Suite adds company, module, submodule and action-level restrictions beneath the Xero ceiling. Access begins at No Access and must be deliberately granted.
Accounts officer
TRACEABILITY BY DESIGN
Every important action keeps a traceable record.
Who acted, for which company, under what authority, on which version, when and with what outcome remain connected for later review.
GOVERNED AND RING-FENCED KX Ai
KX Ai can help with worksheet analysis. It cannot access Xero.
KX Ai may analyse only the worksheet information deliberately shared with it, explain patterns and prepare draft commentary. You review every suggestion and make every decision.
KX Ai-assisted work remains labelled as KX Ai-assisted. Human approval never erases its provenance, and no administrator can override the Xero boundary.
THE GOVERNED FINANCE WORKSPACE