# Just-in-Time Database Access

> Replace standing privileges with just-in-time database access: request, approve, and auto-revoke time-bound, least-privilege grants, fully audited. Open-source.

Source: https://www.bytebase.com/just-in-time-database-access/

---

## Grant database access on request, expire it automatically.

Standing access outlives the task that needed it, and shared credentials make every query untraceable. Just-in-time access flips the default: nothing is standing — access is requested per task, scoped to least privilege, time-boxed, and revoked automatically.

## Request, approve, expire.

### Self-service request

A developer asks for access to a database in-product, with a reason and a duration — no ticket queue, no shared password.

### Approval that fits the risk

A peer, a DBA, or an automated policy grants it; high-risk targets route to a human, routine ones can auto-approve.

### Auto-expiring by default

The grant ends on its own when the window closes, so access reflects what's in use now, not what was ever issued.

## Scoped, masked, audited.

### Least-privilege scope

Grant query, export, or change rights on specific databases and tables — not blanket access to the instance.

### Masking still applies

Sensitive columns stay masked under a temporary grant, so on-demand access never means raw PII. /dynamic-data-masking

### Full request-to-revoke trail

Each access lifecycle is logged end to end: request, reason, approver, scope, and expiry.

## Read in order.

### Just-in-time database access

Time-boxed access granted on request, expired automatically — the opposite of standing access. /blog/just-in-time-database-access

### Database access control best practices

Least privilege, RBAC, just-in-time access, and the controls auditors check. /blog/database-access-control-best-practices

### What is database access control

The fundamentals: authentication, authorization, and audit at the database. /blog/what-is-database-access-control

## Get Started

- [Contact us](https://www.bytebase.com/contact-us/)
- [Start now (cloud)](https://console.bytebase.com)