User roles with administer site configuration permission will be granted administer xero permission.
User roles with access xero permission will be granted query xero permission. It is recommended to remove this permission from anonymous users afterward.