bablsoft/accessflow Quick start Get AccessFlow
Documentation

Run and configure AccessFlow.

Last updated

Read this first

What is AccessFlow?

AccessFlow is a self-hosted query proxy. Your team connects to AccessFlow instead of connecting to the database directly. Every statement is parsed, classified, optionally AI-reviewed, and routed through a configurable human-approval workflow before it touches the database — and customer-database credentials never leave the proxy.

The engines it proxies are PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server (or any other JDBC-compatible engine, via an admin-uploaded driver); the NoSQL document engines MongoDB and Couchbase; the NoSQL key-value engines Redis and Amazon DynamoDB; the NoSQL wide-column engines Apache Cassandra and ScyllaDB; the NoSQL search engines Elasticsearch and OpenSearch; the NoSQL graph engine Neo4j; and the cloud data warehouses Snowflake, Google BigQuery, and Databricks SQL.

This guide is split into three parts: running AccessFlow (pick one of three deployment modes), first-time setup (browser wizard or GitOps env vars), and configuration (every entity an admin manages through the UI or REST API).

The same review, approval, and audit machinery governs two further request surfaces: outbound API calls (REST, SOAP, GraphQL, gRPC) and CI/CD deployments — where a pipeline triggers a governed release request with an API key and blocks on a fail-closed deployment gate until every required approval is granted, with freeze windows, audited break-glass, and post-deploy outcome reporting.

Versions referenced. Internal store is PostgreSQL 18; cache is Redis 8 (used for token revocation and scheduler locks). The backend service and the React-based admin SPA are both shipped as container images — see the Install section on the homepage for the canonical pinned versions, and the Manual / from source section below for build-time toolchain requirements.
Sizing. Two reference points:
  • Evaluation — 2 vCPU · 4 GB RAM · 10 GB SSD on a single host. Fits the Docker Compose demo (backend + frontend + Postgres + Redis) with headroom.
  • Production — backend is stateless: run two or more replicas of (2 vCPU · 2 GB RAM) behind any L7 load balancer. Internal Postgres needs roughly 2 vCPU · 4 GB RAM · 50 GB SSD (audit log dominates disk growth — provision higher IOPS for high-volume orgs). Redis needs ~1 vCPU · 1 GB RAM. Frontend is static — front it with a CDN or any nginx pod.
Numbers are starting points for an org of roughly fifty reviewers and a few hundred daily queries. Scale backend replicas first when you outgrow them.

Every chapter

Read them in any order — each one stands alone.

01

Install & first run

Run AccessFlow with Docker Compose, Kubernetes and Helm, or from source, then complete first-time setup with the browser wizard or GitOps bootstrap.

 02

Users & roles

Configure AccessFlow organizations and quotas, invite users, assign RBAC roles, group them, and grant just-in-time or break-glass access.

 03

Datasources

Add governed datasources to AccessFlow, tag sensitive columns, apply masking, row-level security, and result-export policies, upload JDBC drivers, and watch pool health.

 04

Connectors

Install SQL, NoSQL and data-warehouse engine connectors from the AccessFlow catalog, and register outbound REST, SOAP, GraphQL and gRPC API connectors.

 05

Review workflows

Build multi-stage approval chains with AccessFlow review plans, automate decisions with policy-as-code routing, and run access recertification campaigns.

 06

AI

Configure AI providers for AccessFlow query risk analysis, add a RAG knowledge base, trace prompts with Langfuse, and enable behavioural anomaly detection.

 07

Auth & SSO

Connect AccessFlow to your identity provider with OAuth 2.0 / OIDC or SAML 2.0 single sign-on — Google, GitHub, Microsoft, GitLab, Okta, Keycloak and more.

 08

Notifications

Route AccessFlow review and audit events to email, Slack, Discord, Telegram, Teams, PagerDuty, ServiceNow, Jira and signed webhooks, and configure system SMTP.

 09

Audit & compliance

Read the AccessFlow tamper-evident audit log, generate signed compliance exports, run retention and right-to-erasure policies, and use the personalized dashboard.

 10

End-user workflows

How analysts submit queries and API calls in AccessFlow, draft SQL from natural language, schedule one-off or recurring runs, and how reviewers approve or reject them.

 11

Infrastructure as Code

Manage AccessFlow declaratively with the Terraform / OpenTofu provider, service-account API keys, and the reusable GitHub Actions and GitLab CI templates.

Further reading

This page covers what an operator needs to run and configure AccessFlow. For deeper internals — module boundaries, the proxy engine, the audit log's HMAC chain, the full REST + WebSocket spec — see the engineering chapters in the docs/ folder on GitHub: