docs

VaultKit Documentation

A secure, policy-driven control plane for unified data access across heterogeneous data sources.

VaultKit prevents credential sprawl and enforces data access policies across databases. Write queries in AQL (vendor-neutral JSON), policies decide who sees what, FUNL executes safely. Schema changes require explicit review—no silent data exposure.

---

Documentation

Getting Started

• Main Overview - Complete introduction to VaultKit and FUNL
• Quick Start Guide - Get up and running in 5 minutes
• Installation - Detailed installation instructions
• Deployment Guide - Production deployment instructions**

Core Concepts

• Architecture Overview - How VaultKit and FUNL work together
• AQL Syntax & Specification - Abstract Query Language reference
• Policy Schema Reference - Policy configuration guide

CLI Reference

• VaultKit CLI (vkit) - Complete command-line reference
• Authentication - Login and session management
• Data Requests - Querying data with AQL
• Policy Management - Deploy and manage policies
• Audit Queries - Search and export audit logs

Advanced Topics

• Schema Discovery & Policy Management - Handling schema drift
• Security Best Practices - Key management and deployment
• Use Cases - Real-world examples and patterns

---

Quick Links

For Users:

• Submit a data request
• Fetch query results
• Check request status

For Approvers:

• Review pending requests
• Approve/deny requests

For Administrators:

• Deploy VaultKit
• Register datasources
• Scan for schema changes
• Deploy policy bundles
• Query audit logs

---

Common Workflows

Request Data with Auto-Approval

# Submit AQL query
vkit request --aql '{
  "source_table": "customers",
  "columns": ["id", "email", "revenue"],
  "limit": 10
}'

# Fetch results
vkit fetch --grant gr_abc123xyz

Request Sensitive Data (Requires Approval)

# Submit request
vkit request --aql '{
  "source_table": "financial_transactions",
  "columns": ["transaction_id", "amount"],
  "filters": [{"field": "amount", "operator": "gt", "value": 10000}]
}'

# Check status
vkit requests list --state pending

# After approval
vkit fetch --grant gr_approved_xyz

Discover Schema Changes

# Scan database
vkit scan production_db

# Apply changes to baseline
vkit scan production_db --apply

# Update policies and deploy
vkit policy bundle
vkit policy deploy --bundle dist/policy_bundle.json --activate

---

Key Features

Feature	Description
Zero-Trust Access	Short-lived, cryptographically-signed tokens
Policy-Driven	ABAC/RBAC with field-level controls
Multi-Engine	PostgreSQL, MySQL, Snowflake, BigQuery
SQL-Level Masking	Masking applied during query execution
Schema Governance	Git-backed policies with drift detection
Audit Trail	Complete logging of every data access
Approval Workflows	Multi-stage approvals for sensitive data
Vendor-Neutral	AQL abstracts database-specific syntax

---

Support

• GitHub: github.com/ndbaba1/vaultkitcli.git
• Issues: Report bugs and request features
• Email: Contact the VaultKit Engineering Team

---

License

VaultKit is licensed under the Apache License 2.0.

---

Built with ❤️ by the VaultKit Engineering Team

This site is open source. Improve this page.