Loading page…
Deep Data Security gains restrictive filters and verified identity handoffs. The integrations require configuration; the database then checks which data each user may access.
Listen to this story
Oracle’s October 26, 2026 update adds database-side filters to Deep Data Security, so access granted across multiple roles can be narrowed by business conditions before query results are returned. Configured APEX and ORDS integrations can pass signed-in users’ identity and authorization context for the database to verify, including through a governed Model Context Protocol endpoint. The design gives applications and AI agents a shared enforcement point, but passing identity requires setup; autonomous agents instead use application-identity tokens.
Data grants continue to define role-level row and column access; new filters narrow the combined permissions when multiple grants apply.
APEX 26.2 and ORDS 26.3.0 require configuration to pass OAuth 2.0 identity and authorization claims for database verification.
Keycloak joins OCI IAM and Microsoft Entra ID as a validated identity provider; autonomous agents use application-identity database access tokens.
Oracle wants the database—not an AI agent—to decide which business records a user may access. In an October 26, 2026 announcement, it detailed new controls in Database Release Update 23.26.4 that restrict combined permissions and carry verified identity across more applications. The APEX and ORDS integrations require configuration before they can pass that identity context.
Deep Data Security already enforced end-user permissions through SQL policies called data grants. SQL is the language used to query database tables. Oracle’s concern is that agents can generate queries dynamically and cannot be relied on to enforce a person’s access rights themselves.
A data grant defines the rows and columns available to a role, such as Manager or Recruiter. When several grants apply, their permissions add together. New data grant filters place additional conditions on that combined access.
Oracle illustrates this with recruiting: a Recruiter role grants access to all job requisitions, while responsibility-specific filters restrict access by business unit, country and department. The same rules can govern a recruiting application, analytics dashboard or AI assistant retrieving those records.
APEX 26.2, Oracle’s low-code application platform, and Oracle REST Data Services 26.3.0 can pass identity and authorization information through OAuth 2.0 tokens. The database can cryptographically verify those tokens, which can carry the user, application identity, data roles and other policy attributes.
Oracle REST Data Services, or ORDS, exposes database data through web interfaces. It can also expose a governed Model Context Protocol endpoint—a connection for compatible AI clients and agent frameworks—with the signed-in user’s authorization enforced at the database.
Administrators map identity providers’ token fields to database attributes. The update adds Keycloak as a validated provider alongside OCI IAM and Microsoft Entra ID. For autonomous agents without a human user, database access tokens establish the application identity instead.
Reusable SQL macros let policy authors define an access condition once and reference it in multiple grants and filters. Updating the macro changes the condition used by referencing grants, avoiding separate edits to duplicated rules.
Unified Audit can also record application identity, data roles and end-user context for audited SQL operations, depending on the audit configuration. That context can support troubleshooting, compliance reviews and security investigations.
Story updates
Oracle is putting more security checks around the databases that AI agents and business applications use. At Oracle AI World on October 26, 2026, it announced encryption assessments, smaller test datasets, expanded access controls and simpler network encryption. The package addresses both weak configurations and agents operating with broadly privileged database connections.
Oracle Data Safe, the company’s managed cloud security service, now checks eligible Oracle databases for weak cryptographic settings. Its assessments cover encryption for stored data, network traffic and backups, with guidance on what to change. Examples include outdated TLS 1.0 or TLS 1.1 connections and certificates expiring within two weeks.
The assessment also separates databases needing a software upgrade from those needing configuration changes to adopt quantum-resistant capabilities. A Cryptographic Bill of Materials supplies the underlying configuration inventory.
Data Safe’s new data subsetting creates smaller, representative datasets while preserving relationships between records. Teams can replace sensitive values with fictitious ones through a masking policy in the same workflow. Oracle’s aim is to reduce testing’s storage and processing burden while limiting sensitive information in non-production environments.
An Exadata Database Service integration tackles coverage gaps. Registering a container database automatically registers its existing and newly created pluggable databases with Data Safe, then starts configuration and user assessments.
Oracle’s access-control changes address a different exposure: an agent can follow an unexpected path while still using valid credentials. Applications commonly connect through service accounts that can access records for many people.
Deep Data Security carries a user’s identity, roles and context in cryptographically signed tokens that the database validates. Policies called data grants define permitted rows, columns and operations. New analytics filters can narrow access by territory or business unit. Integrations with Oracle APEX and Oracle REST Data Services pass end-user identity and application context into the database.
Oracle Database ezTLS provides standards-based TLS network encryption without customer-managed certificates or wallets. Oracle says certificate-authenticated TLS remains the choice when clients or servers must prove identity through certificates. ezTLS starts with Oracle AI Database 26ai Release Update 23.26.4 and Oracle Database 19c Release Update 19.33.
The customer-managed Database Security Central has a planned update, described as coming soon, covering:
Expanded auditing, including before-and-after values, for PostgreSQL 16–18 and MySQL 8.4 and 9.7.
Audit-data collection for Windows Server 2022 and 2025, plus Linux/RHEL 10.
Expected centralized monitoring of end-user activity across Oracle AI Databases protected by Deep Data Security.
Oracle also announced backup replication across selected Oracle Cloud Infrastructure regions to support recovery following a primary-region outage. Its free Database Security Central promotion continues through February 28, 2027.
oracle.comLoading discussion...
Join the conversation
Explain when an agent should need extra permission.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.