Skip to main content
Just-in-Time (JIT) access grants database access only when it’s needed and only for a limited time, instead of leaving standing permissions in place. A member requests access, an approver reviews it, and the grant expires automatically — so unused privileges never accumulate, every grant is tied to a stated reason, and each use is recorded for audit. Bytebase offers two ways to request access just-in-time, one per permission model:
  • Request a role — a time-boxed role (e.g. SQL Editor Read User) for a broad range of permissions on the selected databases.
  • Request an access grant — a limited, elevated privilege: run one approved read-only statement, optionally unmasked or exported. See Access Grants.
The two just-in-time approaches converge on expiring, audited access Either way, the request goes through an approval flow and is recorded in the audit log.

​
Choose an approach

Each approach has its own project setting and approval source — the setting turns on role requests or access grants, not the workflow itself. Set them up where each mechanism is documented: Enable role requests and Enable access grants.

​
Expiration and audit

Both approaches end the same way: the access expires on its own — a role binding at its expiration date, an access grant when its approved window (counted from approval) runs out — and the audit log records every query and export along with the role or grant that authorized it. For the full request flows, see Roles and Access Grants.