What AccessFlow can do today, and what's planned
AccessFlow ships as a single open-source product under Apache 2.0 — every capability on this page is in the same release, so the roadmap is a capability map rather than a sales document. The grid below is grouped by what the platform does, not by the release that introduced it; version-by-version milestone scope lives in docs/12-roadmap.md, and the release currently in progress is tracked on the GitHub milestones.
Available now
Everything in this grid is generally available today in v2.4 — self-hosted with Docker Compose or Helm, and governed by the same review pipeline and tamper-evident audit log throughout. The map itself is driven by community input and adapter contributions.
Proxy & data access
- SQL proxy · 6 DBs + custom drivers
- Read-replica routing · result diffing
- Schema explorer & ER view · sample previews
- Datasource health dashboard
- High-volume proxy performance — result caching · query batching · multi-replica load balancing
- Declarative connector catalog
- MongoDB · Couchbase (SQL++) · Redis
- Cassandra & ScyllaDB (CQL)
- Elasticsearch & OpenSearch · DynamoDB (PartiQL)
- Neo4j (Cypher) · text-to-query for NoSQL
- Cloud data warehouses — Snowflake, BigQuery, Databricks SQL (native auth)
AI & monitoring
- Risk scoring + index hints · analytics
- OpenAI-compatible & Hugging Face providers
- Editable prompts · Langfuse · text-to-SQL · RAG
- Offline AI fallback — provider fallback pool with local Ollama
- Approval-likelihood prediction — advisory triage signal from your own review history
- Behavioral anomaly detection (UBA)
- AI optimization & index recommendations
- Expanded MCP agent toolset
Review & access
- Multi-stage approvals · auto-approve reads
- Bulk decisions · scheduled & recurring runs · plan templates
- Reviewer groups & scoping · JIT access
- Policy-as-code routing · row-level security · masking
- Break-glass emergency access
- Multi-tenant orgs & per-org quotas
- Real-time collaborative editing
- Mobile PWA + one-tap push
- Version history & diff · dry-run sandbox · replay
- Personalized dashboard & weekly digest
- Request chaining & grouping
- Group-based data & API access grants
API governance
- Outbound API access governance — REST · SOAP · GraphQL · gRPC
- Operation catalog · response masking · text-to-API
Deployment governance
- Deployment approval governance — gate CI/CD releases behind approval workflows
- Pipelines & environments · per-pipeline trigger grants · AI release-risk analysis
- Fail-closed deployment gate · freeze windows · break-glass · rollback tracking
- GitHub Actions · GitLab CI · Azure Pipelines gate steps
Compliance
- Data classification tagging (PII/PCI/PHI/GDPR)
- Compliance reports & signed exports · Auditor role
- Result-export governance & DLP — watermarked, policy-gated downloads
- Data lifecycle — retention, right-to-erasure & pseudonymization
- Access recertification campaigns
Auth & audit
- JWT · SAML · OAuth/OIDC · SCIM provisioning · TOTP · RBAC with custom roles
- HMAC-chained audit log + CSV export
- SIEM audit streaming & WORM archival — Splunk HEC · syslog/CEF · signed HTTPS · S3 Object Lock
Security & ops
- External secrets managers (Vault / AWS / Azure Key Vault)
- Backup / restore & DR tooling — Helm hooks + audit-chain verification
- ServiceNow & Jira ticketing — auto-created tickets + bi-directional status sync
- Automated sensitive-data discovery — scheduled column scanning proposes classification tags
- Least-privilege intelligence — unused-grant analytics with advisory revocation recommendations
Automation & IaC
- Terraform / OpenTofu provider
- Reusable GitHub Actions & GitLab CI template
Deploy
- Docker Compose · Helm 3 · HPA · health probes
How the capability grid maps to releases
AccessFlow releases in small, themed milestones a few weeks apart rather than one large annual version. A capability graduates from the Planned band into a milestone, ships through the normal review-pipeline and audit machinery, and joins the grid above. The grid never says which release introduced an item — docs/12-roadmap.md does, version by version since v1.0.
The two most recent themes: v2.3 was data-aware governance and reviewer intelligence — automated sensitive-data discovery, advisory approval-likelihood prediction, recurring approved queries, least-privilege analytics over unused grants, reviewer delegation and escalation, result-export DLP, and SIEM / WORM audit streaming. v2.4 added deployment approval governance: CI/CD pipelines ask AccessFlow for permission to release and block on a fail-closed gate, with per-environment policies, freeze windows, audited break-glass, and native GitHub Actions, GitLab CI and Azure Pipelines steps.
In progress now is milestone 2.5.0, which carries deployment governance past the approval gate into what is actually running where: per-environment version tags and current-version state, rollback semantics that restore the prior recorded version rather than merely reopening a review, a version-inventory and drift API that answers which environments are behind and by how much, and a version matrix, per-environment history timeline and drift badges in the web UI. Every open and closed milestone — with the issues inside it — is on GitHub.
What's next
The Planned band holds capabilities that are not yet scheduled into a milestone; an item leaves it when it lands in a milestone, and enters the grid above when it ships. The absence of an engine here is never a blocker — any JDBC-compatible database can be governed today by uploading its driver JAR, and first-class engine plugins are open to contribution.
Planned
- Native wire-protocol gateway
- Column-level permissions
- Custom analyzer plugins (SPI / HTTP)
- Automatic query suggestions