Workflow Jobs: Run As

You can run a workflow job in Oracle AI Data Platform Workbench using the Run As command to determine which user identity is used.

The identity you select when you use Run As governs two things during execution: whose permissions apply, and which credential is used to connect to downstream systems (such as Git repositories or other integrated services).

By default, a workflow could run under the personal identity of whoever built it which creates risk. If that person leaves the organization or their access changes, the workflow can silently break.

Run As solves this by letting you execute workflows under a secure, governed identity instead. This means:
  • Scheduled and automated workflows aren't tied to any one person's login.
  • Workflows keep running even if the original creator is no longer with the organization.
  • Execution identity is explicit, auditable, and controlled by permissions.

Types of Identity

When configuring a job using Run As, you can choose from two types of identity: your own identity and a service account.

Your own identity: AI Data Platform checks whether you have a saved credential in the Credential Store. If one exists, it's used automatically. If not, execution falls back to your standard organizational (IAM) login.

A service account: Service accounts stored in the Credential Store can also be selected as the Run As identity but only if you've been granted at least USE permission on that service account's credential.

Situation Result
You have no credential saved in the Credential Store Job runs using your organizational login. You'll see a warning that the scheduled job may fail if your login session expires (typically after 24 hours).
You have a credential saved in the Credential Store Job runs using that credential and continues to work reliably, with no expiration.
You add a credential to the Credential Store after creating a job The next run automatically switches to using the new credential. If you remove it later, the job falls back to your organizational login.
You switch Run As to a service account you have access to Scheduled runs use the service account's credential, with no expiration.

Ownership in Run and Edit Behavior

Run As also protects against a workflow running under the an incorrect identity when someone other than the original owner interacts with it.

When someone else runs your job: If you grant another user at least USE permission on a job you created, and they run it, Run As switches to them. The job now executes under their login or their saved credential.

When someone else edits your job: If you grant another user at least MANAGE permission and they make changes to the job, Run As switches to them — including for jobs that already have a schedule set. From that point forward, scheduled runs use their credential.

When a Run As is set to a service account: If you've set Run As to a service account, and another user with MANAGE permission later edits the job, the outcome depends on their access to that service account:
  • If they also have at least USE permission on the service account, Run As stays on the service account.
  • If they don't have at least USE permission on the service account, Run As switches to them personally, following the same behavior as above.
By using Run As identity, service accounts can be leveraged as a common credential for multiple users accessing or sharing a workflow job.

Git Repository Access

For jobs that sync a Git repository, AI Data Platform Workbench always uses the Git credentials belonging to the current Run As identity. The Git credentials of another user are never used. If a job runs as a specific user, only the Git credentials of that user are used to pull the repository. If a job runs as a service account, only that service account's Git credentials are used.

Note:

If needed, you can use AI Data Platform REST APIs to set credentials for your service account. See REST API for Oracle AI Data Platform Workbench.

Reliability

AI Data Platform Workbench is confirmed to resolve the correct Run As identity for every job run without adding measurable delay to the job start time.

Scheduled jobs using saved credentials or service account run without failing due to login expiration.

Clear warnings are issued within seconds in circumstances where your credentials are missing and AI Data Platform Workbench falls back to your organizational login.

Run As Monitoring

You can monitor the identity of users for job runs by viewing the job run history. For more information, see View a Job's Run History.

Edit Run As Identity for a Job

You can change the identity a job is run as going forward after the job is created from the Details tab.

  1. On the Home page, click Workflow.
  2. Click the job you want to change the run identity for.
  3. Click the Details tab.
  4. Under Run As, click Edit.
  5. Select your identity or the service account you want to run the job as. Select the service account you want to use from the dropdown menu.
  6. Click Save.
  7. Optional: Click Run now to run the job with the selected identity immediately.