Using Claude Code Safely in a Tax Accounting Firm: Client Data Anonymization and Permissions

In a tax accounting firm, deleting only the company name before giving Claude Code a client’s trial balance or payroll CSV will lead to questions later. The representative’s name, email address, bank account number, business partner name, or My Number may remain in another column or even in the filename. Those details can still reveal whose records they are. The first thing to fix is not the prompt. It is the boundary between the source-data folder and the AI working folder.

For example, Claude Code does not need to open the original CSV to draft questions for a monthly client comment. A working JSON file can replace the company name with “Client A” and convert exact sales into a band such as “JPY 10 million to JPY 15 million.” That is enough to formulate questions. A human remains responsible for tax amounts, filing decisions, and sending anything to the client.

This article builds a workflow in which a tax accounting firm isolates client data from the originals and gives Claude Code only an anonymized working copy. Permission settings are not treated as proof of safety on their own. A preflight scan and human approval are layered on top. The primary next step is training or consultation to define responsibilities and approval procedures inside the firm.

Key takeaways

• Keep originals in raw-client-data/ and copies intended for AI in ai-work/, then configure Claude Code so it cannot read the originals.
• Anonymization means more than removing names. Review contact details, bank accounts, identifiers, business partners, overly precise amounts, and free-text fields.
• Let Claude Code classify anonymized material, build comparison tables, draft questions, and propose comments. Humans decide tax positions, recipients, retention periods, and exception approvals.
• The three use cases are monthly comments, missing-document emails, and pre-filing checklists.
• Measure ROI using preparation time per case, rework counts, blocks raised by the preflight scan, and minutes spent on approval.

Workflow: Create a working copy before opening the originals

Divide the firm’s working directory into four areas: originals, transformation, AI work, and approved output. Put accounting CSV files, payroll ledgers, filing documents, and client emails in the originals area. Put only the fields needed for the stated purpose into JSON, Markdown, or CSV files in the AI working area. Save approved output separately with the reviewer’s name and review date.

Folder	What belongs there	How Claude Code handles it
raw-client-data/	Originals received from clients	Deny both reading and writing
transform/	Anonymization scripts and field maps	A human reviews and runs them
ai-work/	Pseudonymized and range-reduced working copies	Allow reading and writing
approved-output/	Human-approved messages and checklists	A human saves and sends them

The first task is to describe the AI purpose in one sentence. “Write the monthly report” is too broad. Narrow it to something like, “Using the sales band, month-over-month gross-margin change, and number of unpaid invoices, produce three questions for the company president.” A narrower purpose lets you provide fewer fields.

Next, create a field map. Company name, personal name, address, telephone number, email address, bank account, and My Number are removal targets. Replace business partner names, uncommon industries, exact sales figures, and free-text descriptions with aliases or ranges as well. Record who performed the transformation, when it was done, and which rule set was used.

Japan’s Personal Information Protection Commission describes considerations that apply when using a cloud service may constitute outsourcing the handling of personal data in its cloud service provider alert. The firm is expected to confirm the service’s security controls, contractual responsibilities, and oversight of the contractor. Specific personal information that includes My Number must be checked separately against the guidelines for business operators. The configuration examples in this article do not replace legal or contractual review.

What Claude Code can handle and what humans must decide

Claude Code can sort anonymized records, identify missing items, and draft questions and comments. For example, from the facts “the sales band rose from the previous month, but gross margin fell” and “the number of unpaid invoices increased by two,” it can suggest questions for the staff member to ask the client. It does not need the original company name or exact bank balance.

Humans decide the tax conclusion, figures, wording used with the client, recipient, retention period, deletion, and exception handling. Do not send an AI assertion as-is. A licensed tax accountant checks the supporting records and applicable requirements before approval.

Think about permissions in two layers. Claude Code’s Read and Edit denials apply to its built-in tools. The official permissions documentation explains that Bash child processes are not necessarily stopped in the same way, so an operating-system-level sandbox should also be used. Permission rules are evaluated in the order deny, ask, then allow. Deny the originals first, and only then allow the working folder.

Three use cases

Use case 1: Draft questions for a monthly client comment

• Input: client ID, sales band, month-over-month gross-margin change, number of unpaid invoices, and factual notes added by the staff member.
• Output: three questions for the client, a draft monthly comment, and the input fields used as evidence.
• Human review: approve the accounting figures, tax interpretation, circumstances specific to the client, outgoing text, and recipient.

Claude Code can build the structure of a comment without receiving the exact sales amount or company name. Instruct it not to assert why a figure changed, not to add a reason absent from the input, and to turn uncertainty into a question. The staff member sets the priority of those questions while checking the originals. The overall structure of the monthly report is covered separately in the monthly reporting article for tax accounting firms.

Use case 2: Draft an email requesting missing documents

• Input: Client A, target month, types of missing documents, requested response date, and available delivery methods.
• Output: subject line, message body, a bulleted list of missing documents, and instructions for the reply.
• Human review: confirm what is actually missing, the deadline, recipient, attachments, and whether another client’s name was inserted.

In a missing-document email, a wrong recipient or a client name left in the text is more dangerous than imperfect prose. Do not put real names in the AI working copy. Insert them in the email system only after approval. Put this input boundary before the message-drafting workflow described in client emails and review checklists.

Use case 3: Find omissions in a pre-filing checklist

• Input: pseudonymized entity classification, applicable procedure, document categories, received flags, and the reviewer’s role.
• Output: missing documents, questions to return to the staff member, and a draft checklist with approval fields.
• Human review: determine filing obligations, deadlines, required documents, applicable conditions, electronic filing, and final submission.

Claude Code still does not decide whether a filing can be made. Compare checklist items with the existing procedure and ask it to identify possible omissions. A human checks the tax type, fiscal year, notification status, and special-treatment requirements against the originals. Leave fields for “reviewer,” “review date,” and “supporting record” in the output.

Copy-ready prompt

The following prompt assumes that Claude Code reads only anonymized material placed in ai-work/. Do not append real names or exact identifiers to the prompt.

You assist with monthly reviews at a tax accounting firm.
Read only ./ai-work/client-C017.json and produce the following in order.

1. Facts stated in the input
2. Points that cannot be determined from the input alone
3. Three questions to ask the client
4. A draft monthly comment
5. Items a human must check against the originals

Constraints:
- Do not assert a tax conclusion
- Do not add a company name, person's name, amount, or reason that is absent from the input
- Do not send email, delete files, or communicate externally
- If you find a value that appears to be personal information, stop processing and report only the field name
- End the output with "Pending tax accountant review - do not send"

Before running that prompt, use a machine check to confirm that the working copy contains only expected fields. The accompanying scripts/check-tax-accountant-ai-input.mjs scans JSON, CSV, Markdown, and text. It exits with code 1 when it finds field names that appear to contain personal names or contact information, email addresses, telephone numbers, 12-digit identifiers, or postal codes.

node scripts/check-tax-accountant-ai-input.mjs
node scripts/check-tax-accountant-ai-input.mjs ./ai-work
if ($LASTEXITCODE -ne 0) { throw "The preflight check blocked this AI input" }

This scan does not guarantee prevention of a data leak. It cannot interpret every free-text meaning or determine every re-identification risk created by combining fields. A human must still open and inspect the working copy after the scan.

A working permission configuration

In the project’s .claude/settings.json, deny the originals first and allow only the AI working folder. In Claude Code settings, the leading / in /raw-client-data/** is relative to the project root. An absolute path from the computer’s filesystem root begins with //, so do not confuse the two.

{
  "permissions": {
    "deny": [
      "Read(/raw-client-data/**)",
      "Edit(/raw-client-data/**)",
      "Read(/secrets/**)",
      "Edit(/secrets/**)",
      "Bash(git push *)"
    ],
    "allow": [
      "Read(/ai-work/**)",
      "Edit(/ai-work/**)",
      "Bash(node scripts/check-tax-accountant-ai-input.mjs *)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "filesystem": {
      "denyRead": ["./raw-client-data", "./secrets"],
      "denyWrite": ["./raw-client-data", "./secrets"]
    }
  }
}

The official sandboxing documentation says the default behavior when the sandbox cannot start is to warn and continue without sandboxing. This example stops with failIfUnavailable: true and disables the escape hatch with allowUnsandboxedCommands: false. Sandboxing support assumes macOS, Linux, or WSL2. A firm operating on Windows should run it inside WSL2 and should not handle client data on an endpoint where the configuration is ineffective.

After changing the configuration, test that access is actually denied. In a validation folder containing fictional data only, confirm that reading raw-client-data/ is rejected and that Claude Code can read only the working copy in ai-work/. The mere existence of a settings file is not a passing result. The Claude Code permissions guide provides more context for designing deny rules.

Pitfalls: Where anonymization and permissions fail

The first pitfall is assuming that removing the company name completes anonymization. A representative’s name, an unusual transaction, an exact amount, or free text may still identify the client. Fix this by defining an allowlist of fields for each purpose and exporting only the transformed file to ai-work/.

The second pitfall is assuming that a Read denial also stops Bash. The built-in Read and Edit rules and child-process restrictions are different controls. Layer the sandbox’s denyRead and denyWrite settings on top, and use failIfUnavailable to stop processing if the sandbox cannot start.

The third pitfall is declaring the data safe because a scan found zero matches. Regular expressions miss images, text inside PDFs, spelling variations, and personal data that is apparent only from meaning. Use field allowlisting together with a preflight scan, human visual inspection, processing logs, and a deletion deadline.

The fourth pitfall is using real data to test the workflow. Values can remain in test logs and screenshots. Test deny and allow behavior with fictional data, and write the incident stop procedure on a single sheet of paper.

Measure ROI on a small scope

For the first two weeks, measure one type of monthly comment for one client. Before adoption, record five runs of “minutes from opening the originals to completing the draft,” “number of edits by the staff member,” and “number of returns from the firm owner.” After adoption, collect the same measures and add the number of times the preflight scan stopped an input.

For example, if a firm handles 20 cases per month and preparation falls from 18 minutes to 11 minutes per case, it saves 140 minutes per month. Subtract any increase in approval time. In addition to revenue equivalents, record the number of misdirected messages, insertions of another company’s name, and accesses to original data that were prevented before they occurred. Focusing on speed alone creates pressure to skip anonymization.

Compare case count x (preparation minutes + approval minutes + rework minutes) before and after adoption, and place the number of blocked inputs beside it. This shows speed and safety together.

Frequently asked questions

Q. Can we use the data as-is after replacing the client name with an alias?

No. Review the representative’s name, address, email, bank account, My Number, business partners, exact amounts, and free text as well. A human makes the final check that a combination of values cannot reveal the client.

Q. Is it safe if Claude Code runs locally?

The location alone does not decide safety. Review the service’s data handling, authentication, endpoint, logs, external communication, permissions, and contract. Create a boundary that prevents access to originals first.

Q. Can the scanner inspect PDFs and images?

The scanner in this article handles only JSON, CSV, Markdown, and text. Block PDFs and images as unsupported and route them through a separately approved transformation process. Do not silently allow an unsupported format.

Q. May we anonymize My Number and give it to AI?

This article does not make that case-specific decision. As a rule, do not include it in the working copy. The responsible person at the firm must review the Personal Information Protection Commission’s guidelines, the contract, the purpose of use, and internal policies.

Define the boundary through training or consultation

When a tax accounting firm uses Claude Code, a settings file is not enough. Operations will fail if it is unclear who anonymizes data, who approves exceptions, and where output is stored. Assign separate responsibility for originals, working copies, AI output, and approved messages.

In training or consultation, we design the client-data field map, folder boundary, permission configuration, preflight scan, and approval sheet without bringing real data into the session. The first meeting checks only the firm’s existing folder names and the deliverable it wants to create. The originals themselves are not shared.

What we actually tested

For this article, we ran the self-test in scripts/check-tax-accountant-ai-input.mjs using only fictional client JSON. The safe sample is designed to produce zero findings. The unsafe sample, which contains a representative-name field, an email address, and a 12-digit identifier, is designed to stop. Code, commands, internal links, official URLs, the CTA, frontmatter, and the hero image were also included in the pre-publication checks.

The first task today is to create empty raw-client-data/ and ai-work/ folders and use fictional files to test that the originals area is denied while only the working-copy area can be read. Even after that test passes, begin with an anonymized working copy.