Oracle releases engine to run AI agent workflows inside its database

Running an AI agent inside a database does not mean its language model stays there. Oracle on October 26, 2026, made AI Database Agent Engine generally available in Oracle AI Database 26ai. It puts workflow execution beside business data, but calls to external models still cross the network boundary. The key control is what those calls disclose.

The database coordinates the work

Agent Engine runs declarative workflows: definitions that specify the steps and permitted paths through a task. The database maintains workflow state, runs tools and handles retrieval. Oracle says this removes the need for a separate orchestration service dedicated to coordinating those workflows with database data.

The division of labor is explicit. SQL, the language used to query databases, and Oracle's PL/SQL programming language handle operations such as joins, calculations and rule checks. Language models are invoked at defined points when interpretation is needed. Model calls receive structured inputs for that step, not database connections or unrestricted access to tables.

Workflows can run steps in sequence or in parallel, branch between routes, repeat loops, and alternate model reasoning with tool use. They can also include human approval gates. Oracle says a workflow can pause before a consequential action and route approval through existing application controls.

Permission to calculate is not permission to disclose

Oracle's technical documentation illustrates the boundary with a credit decision. A trusted database tool can inspect a customer's credit score, outstanding balance and fraud probability. It can then return a smaller decision contract—a defined set of permitted results—instead of passing those underlying values to the model.

In that example, the model receives a conditional approval, allowed payment terms, a maximum discount and a message code requiring a deposit. It can use those results to prepare a response without seeing the protected source figures. The calling application has its own output boundary: intermediate values reach it only when explicitly mapped to the workflow's final output.

Workflow state and sensitive intermediate results fall under database policy controls, resource limits and auditing. Oracle says every tool call, model call and decision is recorded with its inputs and sources. These controls govern execution and disclosure; external model calls still need to send only the values required for that invocation.

A portable definition, with implementation limits

Agent Engine uses Open Agent Specification, which Oracle says makes workflows portable across compatible implementations. Compatibility is qualified: the documentation specifies support for a documented subset of Agent Spec version 26.1.0. Before execution, the engine validates components, references, paths, and input and output contracts.

Developer entry points

• The DBMS_AI_AGENT package exposes programming interfaces to execute a definition directly or store it by name for repeated use.
• Applications can list, describe and delete stored definitions, and request a structured trace during execution.

Oracle says keeping intermediate results inside the database avoids repeated network trips to an external coordinator, particularly for workflows with several database operations or large intermediate results. Database resource management can also isolate agent workloads from production workloads.

Recovery needs a version check. The launch post says workflows can pause at their last committed state when a model or retrieval dependency becomes unavailable, then resume. The documentation, however, labels resumability and conversations as coming in version 23.26.4.2 and limits recovery to supported execution modes and boundaries. That leaves recovery availability dependent on the deployed version and execution mode.