bablsoft/accessflow Quick start Get AccessFlow
Documentation

Run and configure AccessFlow.

Last updated

Read this first

What is AccessFlow?

AccessFlow is a self-hosted query proxy. Your team connects to AccessFlow instead of connecting to the database directly. Every statement is parsed, classified, optionally AI-reviewed, and routed through a configurable human-approval workflow before it touches the database — and customer-database credentials never leave the proxy.

The engines it proxies are PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server (or any other JDBC-compatible engine, via an admin-uploaded driver); the NoSQL document engines MongoDB and Couchbase; the NoSQL key-value engines Redis and Amazon DynamoDB; the NoSQL wide-column engines Apache Cassandra and ScyllaDB; the NoSQL search engines Elasticsearch and OpenSearch; the NoSQL graph engine Neo4j; and the cloud data warehouses Snowflake, Google BigQuery, and Databricks SQL.

This guide is split into three parts: running AccessFlow (pick one of three deployment modes), first-time setup (browser wizard or GitOps env vars), and configuration (every entity an admin manages through the UI or REST API).

Versions referenced. Internal store is PostgreSQL 18; cache is Redis 8 (used for token revocation and scheduler locks). The backend service and the React-based admin SPA are both shipped as container images — see the Install section on the homepage for the canonical pinned versions, and the Manual / from source section below for build-time toolchain requirements.
Sizing. Two reference points:
  • Evaluation — 2 vCPU · 4 GB RAM · 10 GB SSD on a single host. Fits the Docker Compose demo (backend + frontend + Postgres + Redis) with headroom.
  • Production — backend is stateless: run two or more replicas of (2 vCPU · 2 GB RAM) behind any L7 load balancer. Internal Postgres needs roughly 2 vCPU · 4 GB RAM · 50 GB SSD (audit log dominates disk growth — provision higher IOPS for high-volume orgs). Redis needs ~1 vCPU · 1 GB RAM. Frontend is static — front it with a CDN or any nginx pod.
Numbers are starting points for an org of roughly fifty reviewers and a few hundred daily queries. Scale backend replicas first when you outgrow them.

Every chapter

Read them in any order — each one stands alone.

01

Install & first run

Run AccessFlow with Docker Compose, Kubernetes and Helm, or from source, then complete first-time setup with the browser wizard or GitOps bootstrap.

 02

Users & roles

Configure AccessFlow organizations and quotas, invite users, assign RBAC roles, group them, and grant just-in-time or break-glass access.

 03

Datasources

Add governed datasources to AccessFlow, tag sensitive columns, apply masking, row-level security, and result-export policies, upload JDBC drivers, and watch pool health.

 04

Connectors

Install SQL, NoSQL and data-warehouse engine connectors from the AccessFlow catalog, and register outbound REST, SOAP, GraphQL and gRPC API connectors.

 05

Review workflows

Build multi-stage approval chains with AccessFlow review plans, automate decisions with policy-as-code routing, and run access recertification campaigns.

 06

AI

Configure AI providers for AccessFlow query risk analysis, add a RAG knowledge base, trace prompts with Langfuse, and enable behavioural anomaly detection.

 07

Auth & SSO

Connect AccessFlow to your identity provider with OAuth 2.0 / OIDC or SAML 2.0 single sign-on — Google, GitHub, Microsoft, GitLab, Okta, Keycloak and more.

 08

Notifications

Route AccessFlow review and audit events to email, Slack, Discord, Telegram, Teams, PagerDuty, ServiceNow, Jira and signed webhooks, and configure system SMTP.

 09

Audit & compliance

Read the AccessFlow tamper-evident audit log, generate signed compliance exports, run retention and right-to-erasure policies, and use the personalized dashboard.

 10

End-user workflows

How analysts submit queries and API calls in AccessFlow, draft SQL from natural language, schedule one-off or recurring runs, and how reviewers approve or reject them.

 11

Infrastructure as Code

Manage AccessFlow declaratively with the Terraform / OpenTofu provider, service-account API keys, and the reusable GitHub Actions and GitLab CI templates.

Further reading

This page covers what an operator needs to run and configure AccessFlow. For deeper internals — module boundaries, the proxy engine, the audit log's HMAC chain, the full REST + WebSocket spec — see the engineering chapters in the docs/ folder on GitHub: