# Your AI Agent Wants Your Data. Here's How to Lock It Down - Jeff Smith, Oracle

## Executive summary

Jeff Smith details the architecture of the Oracle AI Database, designed to safely integrate Large Language Models (LLMs) and AI agents into enterprise data workflows. The core focus is mitigating the risks of ad-hoc Natural Language to SQL (NL2SQL) queries by introducing the Model Context Protocol (MCP) server. MCP allows agents to interact with data through vetted, structured tools (like pre-built reports) and read-only standby instances, ensuring data security, performance, and reliability while maintaining a single SQL interface across diverse data sources (data warehouses, data lakes, etc.).

## Key takeaways

- Oracle AI Database Architecture: The database natively supports vectors, allowing it to participate in Retrieval-Augmented Generation (RAG) pipelines. This enables a single SQL interface across various data types (financial, HR, ERP, etc.), eliminating the need to replicate data across multiple platforms.
- Risks of Natural Language to SQL (NL2SQL): NL2SQL is powerful but dangerous because LLMs can generate queries that look correct but return inaccurate data, or they may 'brute force' the database dictionary, leading to high token costs and unreliable results.
- Structured Tooling via MCP: Instead of generating raw SQL, agents should be limited to calling vetted tools or reports (e.g., 'list reports' and 'execute reports'). This limits the LLM's failure surface, making the process more trustworthy.
- Security and Performance Best Practices: For production systems, agents should interrogate a read-only standby instance (using Oracle Data Guard) to prevent performance issues from impacting live data. Security must be implemented at the database layer, not just the tool layer.
- Schema Documentation for Agents: New tools allow consuming internal documentation (like Confluence pages) to generate context and document schema metadata, providing the LLM with the necessary business context to generate accurate queries.

## Technical details

- Oracle AI Database Capabilities: The database supports vectorization, graph data types, and relational tables, providing a unified interface for RAG pipelines. It is designed to handle diverse data types (financial, HR, etc.) through a single SQL interface.
- Model Context Protocol (MCP): MCP is a new protocol that allows for controlled agent interaction. It supports executing arbitrary ad-hoc SQL and stored procedures but can be limited to custom, vetted tools and reports, significantly enhancing safety.
- Data Security Implementation: Security is enforced via organization Single Sign-On (e.g., Azure AD) and 'deep data security.' The database dynamically strips data from the result set before it reaches the agent, ensuring the user only sees data they are authorized to view.
- Performance Tuning (DevOps Use Case): Agents can be directed to a read-only standby instance (via Data Guard) to investigate performance issues. Tools can be used to collect statistics and generate performance profiles (e.g., using AWR) to help the cost-based optimizer generate optimal execution plans.
- Schema Annotation and Context Engineering: New tools allow consuming external documentation (SharePoint, PDFs, etc.) to generate and store schema metadata within the database. This provides the LLM with plain English context, improving the accuracy of generated SQL queries.

## Practical implications

- Build engineers should prioritize implementing security controls at the database layer (Deep Data Security) rather than relying solely on application-level tooling.
- Integrating LLMs requires moving from open-ended NL2SQL to a structured tool-calling model (MCP) that limits agent actions to pre-vetted reports and APIs.
- For performance-critical applications, utilize read-only standby environments (Data Guard) for agent-driven testing and optimization to prevent production disruption.
- Adopting schema annotation tools is critical for providing LLMs with the necessary business context, reducing the need for the agent to 'guess' the data model.

## Topics

Generative AI, Database Architecture, LLM Security, Data Governance, Model Context Protocol (MCP), RAG Pipelines, oracle.com/mcp, AIE CODE summit

Source: https://www.youtube.com/watch?v=LnQce-eHm8k