Enter your idea

Problem

Xero currently allows practices to restrict staff access to specific clients. Under the Clients section, staff members can only view the clients they have been granted access to.

However, when the same staff member clicks on the Tax tab, they can view the full list of client tax returns across the entire practice. This effectively bypasses the client access restrictions that have been configured and undermines the purpose of limiting staff visibility.

Why This Matters

Many firms use client access permissions to:

• Protect confidential client information
• Segregate duties among team members
• Ensure staff only work on their allocated client portfolio
• Meet internal privacy, security, and compliance requirements

If staff can still see all client tax returns through the Tax tab, they gain visibility of clients they were never intended to access.

Proposed Solution:

Introduce a permission setting that aligns the Tax module with existing client access restrictions.

Suggested options:

Only show tax returns for clients a staff member has access to.

If a user can only access 50 assigned clients, they should only see tax returns for those 50 clients.

Allow administrators to hide the Tax tab entirely for selected staff members.

This would be useful for staff who do not require tax return access as part of their role.
Add a dedicated permission such as "View Tax Returns"
Combined with client-level access controls, this would provide greater flexibility and security.

Expected Benefit

This enhancement would ensure consistency across Xero Practice Manager and Tax, strengthen confidentiality controls, and provide firms with greater confidence that staff can only view information relevant to their assigned clients.

Summary

Client access restrictions currently work under the Clients section but are effectively bypassed via the Tax tab. Tax return visibility should respect the same client-level permissions, and firms should have the option to hide the Tax tab for staff who do not require access.