Database access
that expires.
A role covers a scope — any query on those tables. A grant covers one exact statement.
Request Rolea scope, for weeks
Access Grantone statement, for an hour
SQL Editor · hr_prod devProject Developer
SCENARIOQ1 Headcount Report Jan 2
Needsqueries on hr_prod › employee
How longall quarter
Custom Approval
Source Request Role
Rule Read role, up to 90 days
if request.role == "roles/sqlEditorReadUser"
and request.expiration_days <= 90
→ Project Owner
and request.expiration_days <= 90
→ Project Owner
+ add condition
request.role
request.expiration_days
resource.project_id
Longer or broader asks can go to a stricter approver.
SCENARIOCustomer email bounced Apr 12
Needsone customer's real email
How longone lookup
Custom Approval
Source Request Access Grant
Rule Unmask needs a DBA
if request.unmask == true
→ Workspace DBA
→ Workspace DBA
+ add condition
request.data_export
resource.table_name
resource.environment_id
+ more, or raw CEL…
Export, table, environment — any of them can route.
Audit Log
Jan 2 09:10devrequested role SQL Editor Read User
Jan 2 09:14alexapproved the request
Apr 12 10:02devrequested an access grant · unmask · 1 hour
Apr 12 10:05danaapproved the request
Apr 12 10:06devqueried hr_prod · via access grant · unmasked
Apr 12 10:07devqueried hr_prod — denied
bytebase.com/demo/jit-access