Live, read-only — refreshed every 15 seconds

An AI vendor’s agent, reading a customer’s on-prem database. Approved, read-only, on the record.

Acme Muhasebe is an accounting office. Its ERP database sits on a server in its office, with no inbound ports open. FinBot sells an agent that reconciles invoices. Below is the real state of that setup on tunr.sh right now. The company names and numbers are made up; the connector, grants, read-only enforcement and audit trail are the production system.

1 · Connector dials outAcme runs tunr connect on its office server. It only makes outbound HTTPS connections.

2 · Agent asksFinBot’s agent requests read-only access to one named resource, for a set time, with a reason.

3 · Acme approvesEvery grant is approved by the customer, expires on its own and can be revoked at any moment.

4 · Everything is loggedSessions, query summaries and blocked writes land in Acme’s audit log, exportable as CSV.

Acme’s office server

The connector inside Acme’s network.

Site: istanbul-office
Status: online connected 5h 13m ago
Connector: tunr 0.8.0, outbound only
End-to-end TLS: sha256 705521b3b9522a28938f568f…
Resource: acme-muhasebe/erp-db postgres≤ 500 rows/query5 q/s
Acme's Logo ERP: customers (cari), invoices (fatura), payments (tahsilat), stock (stok). Read-only.

Access requests

What FinBot’s agents asked for, and what Acme decided.

Oct 23, 09:07 UTC

invoice-reconciler from finbot expired read-only

Reconcile October invoices against payments for the monthly close

expired on its own

Oct 23, 08:31 UTC

invoice-reconciler from finbot expired read-only

Reconcile October 2026 invoices against payments for the monthly close

expired on its own

Oct 23, 08:20 UTC

invoice-reconciler from finbot revoked read-only

Ekim faturalarının mutabakatı

revoked by Acme

What the agent actually ran

Connections and query summaries for the latest grant (acme-muhasebe/erp-db). Full query text is off: Acme keeps only the command, tables, rows and timing.

The agent hasn’t connected yet.

Acme’s audit log

Decisions, connections and blocked statements, newest first. Individual connection open/close events are left out here; people are shown by role (the real log names them).

Oct 23, 13:24 UTCconnector · connector connected (outbound)

Oct 23, 11:08 UTCtunr bridge · grant expired on its own

Oct 23, 10:31 UTCtunr bridge · grant expired on its own

Oct 23, 09:08 UTCAcme IT · approved invoice-reconciler for acme-muhasebe/erp-db

Oct 23, 09:07 UTCfinbot agent · invoice-reconciler asked for read-only access to acme-muhasebe/erp-db

Oct 23, 08:32 UTCtunr bridge · blocked the agent’s DELETE on tahsilat — the grant is read-only

Oct 23, 08:31 UTCAcme IT · approved invoice-reconciler for acme-muhasebe/erp-db

Oct 23, 08:31 UTCfinbot agent · invoice-reconciler asked for read-only access to acme-muhasebe/erp-db

Oct 23, 08:31 UTCAcme IT · resource updated

Oct 23, 08:30 UTCconnector · connector connected (outbound)

Oct 23, 08:29 UTCAcme IT · connector token rotated

Oct 23, 08:22 UTCconnector · connector disconnected

Oct 23, 08:22 UTCAcme IT · revoked invoice-reconciler — open connections cut in 4 ms

Oct 23, 08:21 UTCtunr bridge · blocked the agent’s SELECT — the grant is read-only

Oct 23, 08:21 UTCtunr bridge · blocked the agent’s DROP — the grant is read-only

Oct 23, 08:21 UTCtunr bridge · blocked the agent’s DELETE on invoices — the grant is read-only

Oct 23, 08:21 UTCtunr bridge · blocked the agent’s UPDATE on invoices — the grant is read-only

Oct 23, 08:21 UTCAcme IT · approved invoice-reconciler for acme-muhasebe/erp-db

Oct 23, 08:20 UTCfinbot agent · invoice-reconciler asked for read-only access to acme-muhasebe/erp-db

Oct 23, 08:19 UTCAcme IT · link created

Set up your own in the dashboard Customer quick start Vendor quick startSnapshot Oct 23, 18:36 UTC