AI configuration.

AI configurations

What it is. The AI brain behind query risk analysis and natural-language "text-to-query". Configure it per organization and point it at the provider that fits your data-egress policy; AccessFlow then scores every submitted query and, where enabled, drafts queries from plain-language prompts. It ships adapters for five providers — pick one:

Which AI providers does AccessFlow support?

Anthropic, OpenAI, Ollama, Hugging Face, and any OpenAI-compatible endpoint. You configure one provider per organization and supply its API key, base URL, and model. Ollama keeps every prompt on your own infrastructure, so no query text leaves the network — the usual choice when data-egress policy forbids a hosted model.

• Anthropic — default model claude-sonnet-4-20250514.
• OpenAI — default model gpt-4o.
• Ollama — self-hosted, set Endpoint to the Ollama server URL.
• Custom (OpenAI-compatible) — any OpenAI API–compatible backend (vLLM, LM Studio, Together, Groq, OpenRouter, …). Set Endpoint to the server's base URL (required); the API key is optional for keyless self-hosted servers.
• Hugging Face — default model meta-llama/Llama-3.3-70B-Instruct. Endpoint defaults to the hosted Inference Providers router (https://router.huggingface.co/v1, authenticated with a HF token) and can point at a local / self-hosted Text Generation Inference (TGI) server or a Dedicated Inference Endpoint. Keyless-capable, so local TGI runs without a token.

Configure it. Create a configuration with the three-step wizard at /admin/ai-configs:

1. Provider. Open /admin/ai-configs, click New configuration, and pick a provider tile (OpenAI / Anthropic / Ollama / Custom OpenAI-compatible / Hugging Face). The wizard pre-fills the default model for the provider you chose.
2. Connection. Name the configuration, optionally override the model, and paste the API key (left empty for Ollama and custom keyless servers; for Ollama, Custom OpenAI-compatible, and Hugging Face providers supply an Endpoint URL instead — required for the custom provider, pre-filled with the router URL for Hugging Face and editable to a local TGI / Dedicated Endpoint). Tune Timeout, Max prompt tokens, and Max completion tokens if your provider has stricter limits.
3. Test. The wizard sends a synthetic SQL snippet to the provider and shows the score, risk level, and any issues so you can confirm the credentials and model are working before you save.

Provider switches take effect immediately — no restart is required. Once saved, link the configuration to a datasource (Datasources → Configuration step) or to a review plan, and AccessFlow scores every matching submission against it.

Editable system prompt. Each configuration has an optional System prompt field (on both the create wizard's Connection step and the edit page). Leave it blank to use AccessFlow's built-in analyzer prompt, or paste your own to add house rules, change tone, or steer the analysis. A custom prompt must contain the {{sql}} placeholder (the query under review is substituted there); the optional {{schema_context}}, {{db_type}}, and {{language}} placeholders are substituted too. Click Load / reset to default to pull the built-in template into the editor as a starting point — saving it blank again reverts to the default. Prompt changes take effect immediately, just like provider switches.

Multi-model orchestration & voting. On the configuration's edit page, enable Multi-model orchestration to run several models in parallel against the same query. The primary model above votes alongside the Additional models you add (each with its own provider, model, optional endpoint / API key, and weight). Pick a Voting strategy — Weighted average (default), Highest risk, or Majority vote — to combine their risk verdicts; issues and optimization suggestions from all models are merged. A common setup pairs a fast, cheap local model with a deeper cloud model. Per-model token cost and latency are recorded for every analysis and charted on the AI analyses dashboard.

Guardrails. Add one or more Guardrail patterns (case-insensitive regular expressions) to block queries whose text matches a pattern before any model is called — useful for prompt-injection strings or content you never want sent to a provider. A blocked editor preview returns an error inline; a blocked submitted query is recorded as a failed (critical) analysis. Each pattern is validated as a regex when you save.

Fallback pool. Give any configuration a Fallback priority (0–100, on the wizard's Connection step or the edit page) to mark it as an organization-wide fallback: when the configuration handling a request fails — provider unreachable, timeout, bad credentials — AccessFlow retries the request once against each fallback in ascending priority order (lower = tried first) before giving up with the original error. Fallback configurations show a Fallback #N tag in the list; clear the field to remove one from the pool. The typical setup marks a keyless local Ollama configuration as priority 0, so query analysis keeps working — air-gap friendly — when the cloud provider is down. Guardrail blocks and rate-limit / budget rejections never trigger the fallback pool.

Langfuse integration

AccessFlow optionally connects to Langfuse for LLM observability and prompt management, configured per organization at /admin/langfuse (enable the integration, set the host — defaults to https://cloud.langfuse.com — plus the public/secret key, which is stored encrypted and never shown again). Two independent toggles: Send analysis traces emits a trace of every AI analysis (input SQL, structured output, model, token usage, latency) to Langfuse; Use Langfuse-managed prompts lets each AI configuration point at a Langfuse prompt by name + label (the Langfuse prompt name / Langfuse prompt label fields on the AI config pages) so you can iterate on prompts in Langfuse without redeploying. Both are best-effort and non-blocking — a Langfuse outage never affects query workflow. Use the Test connection button to verify your credentials.

RAG knowledge base. Each AI configuration can carry a retrieval-augmented-generation knowledge base. Toggle Enable RAG on the create wizard's Connection step or the edit page, pick a Vector store — In-app (pgvector), which stores vectors in AccessFlow's own PostgreSQL, or Qdrant (supply the endpoint, collection, and optional API key) — and configure a dedicated Embedding provider + model (OpenAI, Ollama, OpenAI-compatible, or Hugging Face; Anthropic has no embeddings API). Then add Knowledge documents (data-governance policies, naming conventions, schema notes) on the edit page; each is chunked, embedded, and stored. At analysis and text-to-query time the most relevant chunks are retrieved (tune Top-K and Similarity threshold) and injected into the prompt, so the AI follows your house rules. Use Test RAG connection to verify the embedding model and vector store are reachable. Retrieval is best-effort — a store outage never blocks analysis.

Tune it. Langfuse observability: ACCESSFLOW_LANGFUSE_DEFAULT_HOST (https://cloud.langfuse.com), ACCESSFLOW_LANGFUSE_PROMPT_CACHE_TTL (PT60S), ACCESSFLOW_LANGFUSE_CONNECT_TIMEOUT (PT5S), ACCESSFLOW_LANGFUSE_REQUEST_TIMEOUT (PT10S). RAG: ACCESSFLOW_RAG_PGVECTOR_ENABLED (true), ACCESSFLOW_RAG_PGVECTOR_AUTO_PROVISION (true), ACCESSFLOW_RAG_PGVECTOR_DIMENSIONS (1536), ACCESSFLOW_RAG_CHUNK_SIZE (800), ACCESSFLOW_RAG_MAX_DOCUMENT_CHARS (100000). Per-org guardrails: ACCESSFLOW_AI_RATE_LIMIT_REQUESTS_PER_MINUTE (30; <= 0 disables) and ACCESSFLOW_AI_RATE_LIMIT_TOKENS_PER_MONTH (0 = unlimited).

AI analyses dashboard

What it is. An org-wide trend view of every AI analysis. Use it to spot risk-pattern drift, see which queries the AI consistently flags, compare each model's cost and latency, and decide whether a stricter review plan or schema-level guardrails are warranted. /admin/ai-analyses charts the average risk score over a configurable window, the most frequent issue categories, the most active submitters, and — per model — token cost and average latency.

Configure it. Nothing to set up — the dashboard fills in automatically once a datasource has AI analysis enabled.

Behavioural anomaly detection (UBA)

What it is. Spots when a user's database activity drifts from their own normal pattern — a spike in query volume, access at odd hours, reaching for tables they've never touched, unusual query types or row counts, or a jump in errors — and flags it for an admin. Use it to catch compromised accounts, insider misuse, or credential sharing that static rules would miss. It learns each user's baseline from audit-log metadata only — never query result data.

Configure it. Nothing to switch on — it runs automatically once a user has built up enough history (until then they're left alone). Flagged anomalies appear on /admin/anomalies and fire a notification across every active channel (including PagerDuty), and a flagged user's next query is escalated to stricter review. ADMIN and the read-only AUDITOR role can review anomalies; only ADMIN can acknowledge (triaged) or dismiss (false positive) one. Each anomaly can also carry an optional AI natural-language explanation.

Tune it. Sensitivity and cadence via the ACCESSFLOW_AI_ANOMALY_* environment variables: ACCESSFLOW_AI_ANOMALY_DETECTION_POLL_INTERVAL (how often it runs, default PT15M), …_LOOKBACK_WINDOW (aggregation window, PT1H), …_Z_SCORE_THRESHOLD (how far from normal counts as anomalous, 3.0), …_IQR_MULTIPLIER (1.5), …_MIN_SAMPLE_SIZE (history required before a user is scored, 7), …_MAX_BASELINE_SAMPLES (90), …_OFF_HOURS_THRESHOLD (0.02), and …_SUMMARY_ENABLED (AI explanations on/off, true).

AI rate limit & cost budget. Two per-organization guardrails protect the provider API key from a runaway editor or compromised account, enforced before every AI analysis call (editor preview, text-to-SQL, and the async analysis on query submit). ACCESSFLOW_AI_RATE_LIMIT_REQUESTS_PER_MINUTE (default 30; <= 0 disables) caps requests per minute via a Redis counter, and ACCESSFLOW_AI_RATE_LIMIT_TOKENS_PER_MONTH (default 0 = unlimited / opt-in) caps the summed prompt + completion tokens of the org's analyses in the current calendar month. When a limit is hit, the synchronous editor paths return HTTP 429 and the async path records a CRITICAL "AI budget exhausted" / "AI rate limit exceeded" analysis row so human review still proceeds.