Networking for Deployments

In OCI Generative AI, by default, deployed applications have outbound access to the public internet. This allows agent workloads to access external resources such as public MCP servers, third-party APIs, foundation model endpoints, and other internet-hosted services.

For private networking, you can enable Customer Networking Mode. In this mode, you specify a target subnet in a VCN within your tenancy. The platform establishes a secure connection between the agent workload and the subnet by using a Private Endpoint / Reverse Connection Endpoint (PE/RCE).

When enabled, all outbound (egress) traffic from the agent is routed through the specified subnet. This allows:

• Secure access to private resources in your network (for example, databases, compute instances, and internal services)
• Traffic to remain within private network boundaries
• Network security controls such as Network Security Groups (NSGs), route tables, and firewalls to govern outbound connectivity
• Restriction or disabling of public internet access, based on your security requirements

This model supports both internet-facing workloads and private, enterprise-integrated deployments while maintaining clear network isolation between the platform and your environment.