Moving security, privacy, and business-rule enforcement into the data layer for agentic AI
Oracle announced its Deep Trust AI Architecture at its recent Oracle AI World in Las Vegas. The blueprint places security, privacy, and business-rule enforcement across four layers of the enterprise stack (software platform, data, data access, and application development) and draws on Oracle AI Database, Oracle Autonomous AI Database, and the Oracle APEX AI Application Generator.
Oracle compares the effort to its Maximum Availability Architecture, the reference design that customers already use to keep mission-critical systems running.
The announcement addresses a specific failure mode. Agents that access databases via MCP servers or natural-language-to-SQL tools can bypass access rules that exist only in application code, and AI-generated applications can implement those rules incorrectly.
Oracle moves enforcement into the database, so identity checks, access policies, and business rules apply to every SQL request, whether submitted by a person, an application, or an agent.
Details
Oracle’s Deep Trust AI Architecture is a framework that bundles new and existing capabilities into four layers, bringing together proven capabilities across its database and application development products. The common design principle is enforcement at the lowest level, where every request must pass through.
The sections below follow Oracle’s four layers.
Software Platform
Autonomous AI Database manages the platform layer. Oracle states that it applies security updates to the database engine, operating system, storage, and firmware before the fixes are public, in response to attackers using AI to find and reverse-engineer vulnerabilities.
The platform layer includes the following capabilities:
- Rolling patching proceeds in stages so applications keep running during updates.
- Always-on encryption protects data at rest and in motion, with transparent decryption for authorized users and applications.
- Autonomous AI Database runs across leading hyperscalers and on-premises through Oracle Cloud@Customer.
- For co-managed cloud and on-premises systems, Oracle offers security and patching tools free of charge or at steep discounts through the end of February 2027.
Data
The data layer enforces rules at the source. Oracle Deep Data Security lets organizations define end-user access rules in Oracle AI Database and applies them to every SQL request. The database verifies identity using a cryptographically signed token issued by the corporate directory, then determines what the user can access.
Oracle SQL Assertions complement identity-based access by enforcing business rules within the database. Oracle’s example is blocking a charge that exceeds an employee’s spending limit, and the rule applies regardless of which application, user, or agent submits the change.
Data Access
The data access layer governs how agents and applications access data and how accurately AI interprets business questions. It adds four components:
- Oracle Deep Trust Data APIs: Provide controlled read and write access to logical business objects, such as purchase orders. Applications and agents work with the objects a task requires, and the database enforces what each caller can see and modify.
- Oracle Deep NL2SQL: Combines business knowledge, including an organization’s terminology, practices, and metrics, with data definitions. Oracle claims this approach yields more accurate SQL than traditional NL2SQL methods.
- Continuous Feedback Learning: Lets users correct inaccurate responses.
- Knowledge Change Verification: Validates those corrections before they enter the corporate knowledge base.
Application Development
The APEX AI Application Generator enables AI coding agents to translate natural-language application descriptions into APEXlang, an open, declarative application definition language. The AI produces only the definition.
The APEX runtime executes it and provides security, scalability, and availability, so organizations do not have to review, secure, and maintain large volumes of AI-generated code. Developers can work in VS Code, Oracle APEX, or with any AI coding agent such as Codex.
Analysis
Deep Trust AI Architecture extends Oracle’s long-standing argument that the database is the right place to enforce the properties enterprises cannot afford to lose. Maximum Availability Architecture made that case for uptime, and Oracle now makes it for AI trust.
This builds on Oracle’s existing products, keeping the story coherent for existing customers and giving its field organization a named blueprint to sell against.
Practitioner Impact
Database administrators, security architects, and application owners gain a single enforcement point for agent access and take on the work of defining policy centrally. Access rules that previously lived in each application move into the database, reducing the number of places a flaw can hide and increasing the importance of getting the central definitions right.
Competitive Impact
Oracle competes with data platforms that govern access via catalogs and policies, hyperscalers that integrate identity, governance, and model guardrails across many services, and AI security vendors that control agent behavior at the network or runtime layer.
Each approach places the control point in a different location, and the table below compares these approaches to the Deep Trust AI Architecture.
| Alternative | Model/Approach | Key Strength | Compared to Deep Trust |
| Snowflake | Policy-based governance inside the data platform, with row access and masking policies | Governance across shared and multi-cloud data | Comparable in-platform policy enforcement. Reach depends on data residing in Snowflake, while Oracle ties enforcement to transactional systems of record. |
| Databricks | Unity Catalog governance across lakehouse data and AI assets | Unified control over analytics and ML assets | Strong for analytical and ML estates. Oracle’s SQL Assertions and Data APIs address transactional integrity more directly. |
| Microsoft | Entra identity, Purview governance, and row-level security in SQL Server and Azure SQL | Identity and productivity integration | Broadest identity footprint with governance spread across separate services. Oracle offers tighter in-database integration with narrower reach. |
| AWS | IAM, Lake Formation fine-grained access, and Bedrock Guardrails at the model layer | Policy across many AWS data services | Wider service coverage within AWS. Oracle concentrates enforcement inside the database engine itself. |
| Google Cloud | BigQuery row and column security with Dataplex governance | Governance for analytics and AI on Google data | Strong for analytics workloads. Oracle holds the advantage for operational databases. |
| AI security platforms | Runtime and network inspection of agent traffic and prompts | Visibility across any data source or agent | Control agent behavior independent of the database. Oracle controls what the database releases regardless of the agent, so the two address different points of failure. |
Oracle’s differentiation is strongest when the system of record is an Oracle database and the risk is an agent acting on transactional data. SQL Assertions and the Data API model have no direct equivalents in the analytics-centered platforms.
The weakest points are reach and ecosystem. Competitors already occupy the multi-cloud paths agents traverse, and several offer governance that spans data stores Oracle does not control. Oracle also faces the challenge of demonstrating that in-database enforcement holds up under adversarial testing.
| Analyst Take Oracle’s strongest argument is that an agent cannot retrieve what the database refuses to return. The test is how many enterprise agents route through Oracle databases. |
Final Thoughts
Oracle has done well to precisely identify the problem and to place its answer in the layer where it holds the strongest hand. The four-layer structure gives customers a clear way to evaluate agent risk, and the combination of Deep Data Security, SQL Assertions, and governed Data APIs addresses the bypass problem that arises when agents access databases directly.
As with Maximum Availability Architecture, a reference blueprint also provides customers and Oracle’s field teams with a shared vocabulary for planning.
For customers that keep their systems of record in Oracle databases, Deep Trust AI Architecture provides a concrete enforcement point in front of every agent, which is why they should take it seriously.
Oracle has made the database the control point for agent access to enterprise data, and every competitor now needs to demonstrate that its enforcement point holds up as well.
