mailwal

Just-in-time database access: granted on request, gone on expiry (5/7)

Bytebase

Get Started

Bytebase

Access on demand, not forever (5/7)

Who can query what is usually decided once, at onboarding — access is handed out for a single investigation and quietly stays for years.

Just-in-time access turns that around. You request access when you need it, an approver reviews it, and the grant expires on its own — so unused access never piles up, and every grant has a reason and a record. It comes in two forms:

Request a role
A time-limited role — SQL Editor User, say — on the databases you name. Good for open-ended work like debugging a report or exploring a new schema. It behaves like a normal grant that happens to end.
Just-in-time data access
Tighter. You put the read-only statement into the request, and that exact statement is the only thing the grant runs — even a small edit to the SQL is denied. You can also ask to unmask or export the result.

The approver decides with the whole picture in front of them: which databases, the exact statement, whether unmasking or export was asked for, when it expires, and why. Sensitive requests route to stricter approval flows you define, and masking still applies unless unmasking was approved as its own decision.

Bytebase — the standard for database governance.

SOC 2HIPAA