Console AI Experience Preview Availability

Console AI is a new conversational experience in the OCI Console that helps you work faster using natural language. It supports a wide range of use cases, including exploring resources, creating and managing supported OCI resources, troubleshooting issues, understanding billing and usage, and learning how to complete common OCI tasks.

Console AI operates within your current existing OCI Identity and Access Management (IAM) permissions. It uses your OCI context, including your selected region, compartments, resources, and permissions, to provide relevant guidance and run supported workflows on your behalf. Actions that modify resources always require your review and approval.

Availability

Console AI Experience Preview is available:

• To Free Tier and Always Free customers.
• To commercial OCI customers in the OC1 realm with a home region of:
  • US East (Ashburn) (IAD)
  • US West (Phoenix) (PHX)

  We plan to add more home regions for commercial OCI customers over time.

Enable Console AI

To enable and launch Console AI:

1. Sign in to the OCI Console.
2. From the Console home page, scroll to Experience Previews.
3. Select Opt in to experience previews.
4. Turn on Enable experience.
5. Select Launch Console AI.

Important Information

• Console AI is a limited, pre-production pilot. Do not use Console AI with production data or share sensitive information.
• Service Request (SR) creation is not currently supported. Use Ask Oracle to create a service request or engage with a live support agent.

Feedback

We are actively improving Console AI, and your feedback helps shape the experience. To share feedback, use the Help Us Improve link in the Console AI panel or email oci-research-internal-feedback_ww@oracle.com.

Administrative Governance

Governing Console AI access

Tenancy administrators can use OCI IAM deny policies to control how Console AI accesses OCI resources on behalf of users. Console AI operates within each user's existing IAM permissions. Deny policies provide an additional layer of administrative control without changing users' existing permissions for the Console, CLI, SDK, or API.

The following examples illustrate common governance scenarios.

Important

OCI IAM deny policies are opt-in feature and must be enabled before you can use them. Only members of the default Administrators group in the default identity domain can enable deny policies in the Console. Enabling this feature is permanent.

• Restrict Console AI access for a group

  Prevent members of the AIDev group from accessing OCI resources through Console AI:

  Deny group AIDev to inspect all-resources in tenancy
  where request.obo-service.name = 'oci-mcp-server'

• Restrict Console AI access in a compartment

  Prevent members of the Contractors group from accessing OCI resources through Console AI in the Finance compartment:

  Deny group Contractors to inspect all-resources in compartment Finance
  where request.obo-service.name = 'oci-mcp-server'

• Restrict Console AI access to specific resource types

  Prevent members of the Developers group from managing networking resources through Console AI:

  Deny group Developers to manage virtual-network-family in tenancy
  where request.obo-service.name = 'oci-mcp-server'

Replace the group and compartment names with values from your environment. The request.obo-service.name = 'oci-mcp-server' condition ensures that the policy applies only to requests made through Console AI on behalf of users. This condition doesn't affect access from the Console, CLI, SDK, or API. Because deny metaverbs are inverted, denying the inspect permission also denies the higher-level read, use, and manage permissions for matching Console AI requests.

Considerations for chained tasks

Console AI deny policies are evaluated against the service that makes the OCI API request. As a result, they apply only to requests made directly by the Console AI service principal.

Some Console AI tasks invoke additional OCI services to complete a workflow. For these chained tasks, the deny policy does not apply to downstream requests made by another OCI service.

For example, you might create a deny policy that prevents members of the Developers group from managing networking resources through Console AI:

Deny group Developers to manage virtual-network-family in tenancy
where request.obo-service.name = 'oci-mcp-server'

If a user asks Console AI to create a Compute instance, Console AI starts the request, but the Compute service subsequently performs the required networking operations. Because those downstream requests are made by the Compute service rather than the Console AI service principal, the Console AI deny policy does not apply, and the networking operations are not blocked. If you need to restrict downstream operations, create additional deny policies that target the appropriate OCI service or resource.

For more information about enabling and using OCI IAM deny policies, see the Oracle Cloud Infrastructure documentation for Deny Policies.