Oracle Adds Access Controls for AI Agents to Its Database and Cloud

Title: Oracle Adds Access Controls for AI Agents to Its Database and Cloud

Date: 4 June 2026

Type: Blog

Author: SAASiQ (contact@saasiq.ai)

Word count: 1457 words

Reading time: 6 min

Published: 04-06-2026

Tags: #OracleAI #OCI #MCP #AgenticAI #EnterpriseAI #DeepDataSecurity #Database26ai #FusionDataIntelligence #Earnings

Oracle made Deep Data Security available in Oracle AI Database 26ai on 1 May, and on 12 May it added managed MCP servers to its OCI Database Tools service. Both control what an AI agent can see and run when it works against an Oracle database on a user's behalf. They arrive alongside OCI Enterprise AI, Oracle's agent development service, which has been generally available since 31 March. Oracle reports its fiscal 2026 results on 10 June, having raised its fiscal 2027 revenue target to $90 billion in March.

What Deep Data Security enforces

Oracle first described Deep Data Security in its AI Database announcements on 24 March. Vipin Samar, Oracle's senior vice president for database security, announced its availability on 1 May, and his post sets out the problem it is meant to solve. Most business applications connect to the database through one highly privileged account and do the per-user filtering themselves, which works because their queries are written in advance and can be checked. An AI agent inherits that same connection but writes its own queries, and it can be steered by a prompt into running ones nobody intended.

Deep Data Security moves the filtering into the database. The identity of the user and the agent, along with the context of the request, is passed to the database at runtime, and policies written in SQL decide which rows, columns and individual cells come back. Oracle's own example is an HR table: an employee sees only her own record, and her manager sees his reports' records but not their social security numbers or home addresses, whether the query comes from an agent, an application or a SQL tool.

According to the FAQ Oracle published on 11 May, a value the user is not allowed to see comes back as NULL by default, and a function called ORA_IS_COLUMN_AUTHORIZED tells an application whether a NULL is real or hidden. An UPDATE fails if any value it changes is outside the user's rights, and DELETE is controlled row by row. The same policies can apply to vector search, so retrieval for RAG only returns document segments the user is cleared for. Activity goes to the database audit trail with the end user named.

What it needs and what it costs

Deep Data Security is included in the Free, Standard and Enterprise Editions of Oracle AI Database 26ai and in Oracle's cloud and multicloud database services, according to the FAQ. It is a 26ai feature, so databases still on 19c do not have it. It needs the client drivers that shipped with the 26ai April Release Update (JDBC 23.26.2, python-oracledb 4.0 and ODP.NET 23.26.200), and at launch it accepts identities from OCI IAM, Microsoft Entra ID or users defined locally in the database.

In the first release, policies are written in SQL, with an interface in APEX and Data Safe planned. One common set-up, where a middle tier runs a single application through a shared connection-pool identity, is due in the next release. A full Data Pump export does not carry the Deep Data Security objects, and customers who need that must ask Oracle Support for a one-off patch. Virtual Private Database and Real Application Security remain supported, and Oracle says moving from VPD is not automatic.

Managed MCP servers for Oracle databases

The Model Context Protocol is the open standard AI assistants use to discover and call tools. Oracle released an MCP server in SQLcl in July 2025, which runs locally on a developer's machine with that user's database credentials. On 12 May Jeff Smith and Kris Rice of Oracle's database tools team announced the OCI Managed MCP Service for Oracle AI Database, which runs the MCP server inside OCI Database Tools over HTTPS.

An administrator defines MCP servers, groups tools into toolsets, and publishes SQL Reports, which are fixed, parameterised queries that an agent can run without writing its own SQL. Users sign in with OAuth 2.0 through OCI identity, and an existing provider such as Entra ID can be federated in. Three roles come built in: MCP_User, which Oracle suggests limiting to named reports, MCP_Operator, which can also run ad hoc SQL through the run-sql tool, and MCP_Administrator, which manages the servers and tools.

The service covers 26ai and 19c databases in OCI, including Autonomous AI Database and Exadata Database Service, and Oracle databases running on AWS, Azure and Google Cloud. Oracle says there is no charge for the MCP capability; customers pay for the database, the queries it runs and whichever LLM they connect, since the service provides the gateway and the customer brings the agent. According to the 11 May FAQ, the teams behind Oracle's hosted SQL MCP servers, including the Database Tools one, were still working to adopt Deep Data Security.

OCI Enterprise AI and its models

Oracle announced OCI Enterprise AI on 24 March, and the release notes date general availability to 31 March, in nine regions including London and Frankfurt. It combines model access, agent building and hosting, and governance controls in one service. It is compatible with OpenAI's Responses API, supports MCP for tools and A2A for agent-to-agent calls, and organises work into projects with their own data-retention and memory settings. Its NL2SQL feature answers questions against a customer's database 'in a permission controlled manner', in the release notes' words, without copying the data out.

xAI's Grok 4.3, a reasoning model with a one million-token context window, has been available in the service since 1 May. NVIDIA's Nemotron 3 Nano Omni, an open model that works across video, audio, images and text, was added by the time of Oracle's 8 May AI roundup.

The engineering posts from late May

Oracle staff and consultants also wrote several blog posts in the last week of May about building on these services. On 29 May Nikhil Verma described a custom MCP server he built to run OCI through natural language, with more than 35 tools in eight groups, from creating and terminating compute instances to scanning for vulnerabilities and applying fixes. He writes that it inherits OCI IAM policies, so the agent can only do what the signed-in user is allowed to do. It is a build described in a blog post, with no product listing or price.

The same day, an Oracle consulting team wrote up how it self-hosts Langfuse, an open-source tracing tool, on a VM or on Oracle Kubernetes Engine, with credentials held in OCI Vault. Their rule is one user request to one trace, so every model call, tool call and sub-agent appears in a single tree with its latency, token count and cost. Other posts covered an ADS Regression Operator for OCI Data Science (27 May), which compares linear regression, random forest, KNN and XGBoost models by cross-validation from a YAML file, and an AI Accelerator Pack for video search built on NVIDIA's blueprint, which in Oracle's tests summarised a 60-minute video in about 51 seconds.

Fusion Data Intelligence customers

On 21 May Oracle named Heathrow, Kent and MTN as users of Fusion Data Intelligence, its analytics service for Fusion Cloud Applications. Heathrow, which handled almost 85 million passengers last year, runs it for ERP and HCM, with governed access to sensitive data, and Alan Petrie, its head of corporate data and analytics, said it lets the airport combine revenue and passenger data. Kent is a global energy services company formed by a merger in 2021, which moved thousands of users and dozens of systems onto Fusion and uses the analytics for purchase orders, committed spend and supplier risk. MTN, Africa's largest mobile operator with more than 300 million subscribers, uses it for working capital, freight and customs, and procurement.

The numbers due on 10 June

At its third-quarter results on 10 March Oracle reported revenue of $17.2 billion, up 22 per cent, cloud applications revenue of $4.0 billion, and remaining performance obligations of $553 billion. It kept its fiscal 2026 guidance at $67 billion of revenue and $50 billion of capital expenditure, and raised its fiscal 2027 revenue guidance to $90 billion. That $90 billion is a revenue figure, and the March release gave no capital expenditure guidance for fiscal 2027. Oracle said in February that it intended to raise up to $50 billion in debt and equity during 2026, and raised $30 billion within days through bonds and mandatory convertible preferred stock.

SAASiQ's view is that for Oracle database customers the useful part of these releases is where the rules live: in database policies and OCI IAM roles, which DBAs and security teams already administer and audit, rather than in each agent's own code.

Oracle reports its fourth-quarter and full-year fiscal 2026 results after the market closes on 10 June, with a call at 4pm Central Time.

SAASiQ - Intelligent Solutions for SaaS ©