Skip to content

Permission Sets Explained

A Permission Set defines what data a member can query on a specific connected data source. Kipper ships with three pre-configured permission sets per source — they are the same three levels available on the Members invite form.

The three permission sets

Permission Set Description
Full Access (Read only) Unrestricted access to all financial data, reports, and analytics.
Accounts Receivable (Read only) Customers, invoices, payments, credit memos, and refunds.
Accounts Payable (Read only) Vendors, bills, bill payments, and vendor credits.

Every set is read-only. Kipper cannot write, edit, or delete records in your finance system under any permission level.

Where to manage them

You can manage permission set assignments from two places — pick whichever fits how you're working:

From the data source (manage everyone on one set)

Best when you want to see and change every member assigned to a specific permission set on a data source.

  1. In the Kipper portal, go to Data Sources in the sidebar
  2. Open the data source you want to manage (for example, QuickBooks Online)
  3. Scroll to the Access card on the data source detail page — the three permission sets are listed with the members currently assigned to each
  4. Click Manage next to a permission set to add or remove members for that set on that data source

From the member detail page (manage one person across sources)

Best when you want to change one specific member's access, especially across multiple data sources.

  1. Go to Members in the sidebar
  2. Click the member's name to open their detail page
  3. Scroll to the AI Data Access card — it lists the member's assigned permission sets, the data source each one applies to, and the access level
  4. Add or remove permission sets directly from that card

Either path updates the same assignment — you'll see the change reflected on both surfaces.

Who can manage permission sets

Only workspace admins can view or change permission set assignments. Members with a Standard role cannot see the Manage action.