# Desk log CFD-READONLY-20260823

**Status:** First-party illustrative sanitized composite; not customer data, an access-control audit, penetration test, or certification  
**Page:** https://infinisynapse.com/en/blog/connect-finance-database-to-ai  
**Run ID:** `CFD-READONLY-20260823`  
**Run date:** 2026-08-23  
**Evidence package checked:** 2026-08-31  
**Operator:** InfiniSynapse Data Team  
**Attestor:** William Zhu, InfiniSynapse cofounder ([GitHub @allwefantasy](https://github.com/allwefantasy))  
**Contact for contradictions:** zhuhl@infinisynapse.com

## Experience and accuracy record

The desk inspected an illustrative finance connection before allowing a variance question. The proposed role exposed three intended views, blocked payroll and vendor-bank detail, but initially included a mapping synonym with a write path. The operator rejected that synonym and retained only three SELECT-scoped views.

The second pass asked August opex versus Budget v3. The illustrative driver table showed +$210k contractors and a +$40k mapping miss. Those values describe the scenario only; no source ledger, grants export, query log, or customer environment is published.

## Permission matrix

| Object | Proposed role | Final role | Decision |
|---|---|---|---|
| P&L actuals view | Allowed | Allowed | Retain SELECT |
| Budget v3 view | Allowed | Allowed | Retain SELECT |
| Cost-center headcount totals | Allowed | Allowed | Retain SELECT |
| Payroll register | Blocked | Blocked | Exclude sensitive detail |
| Vendor bank fields | Blocked | Blocked | Exclude sensitive detail |
| Mapping write synonym | Allowed | Blocked | Reject write path |

The [machine-readable matrix](https://infinisynapse.com/blog-media/connect-finance-database-to-ai/downloads/permission-matrix-CFD-READONLY-20260823.csv) and [verification script](https://infinisynapse.com/blog-media/connect-finance-database-to-ai/downloads/verify-CFD-READONLY-20260823.py) verify published transcription, not the private system.

## Accuracy checks required in a real deployment

1. Export effective grants from the database rather than relying on UI labels.
2. Test SELECT on allowed views and denial of INSERT, UPDATE, DELETE, DDL, and privileged functions.
3. Trace freshness, row counts, nulls, duplicates, and period cutoff against approved source records.
4. Confirm views and synonyms do not invoke write-capable functions.
5. Retain the grant export, query log, source version, reviewer, and exceptions.

## External context, not validation

- [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) (retrieved 2026-08-31)
- [PostgreSQL GRANT documentation](https://www.postgresql.org/docs/current/sql-grant.html) (retrieved 2026-08-31)
- [U.S. GAO Assessing Data Reliability](https://www.gao.gov/products/gao-20-283g) (retrieved 2026-08-31)
- [UK Government AQuA Book](https://www.gov.uk/guidance/the-aqua-book) (retrieved 2026-08-31)

None of these publishers reviewed this desk run or InfiniSynapse.