Oracle AI Database Agent Engine

Overview

Oracle AI Database Agent Engine executes supported agents and workflows within Oracle AI Database. It brings workflow orchestration close to database data, procedures, transactions, and security controls while retaining Agent Spec as the portable definition. Oracle AI Database Agent Engine supports the documented subset of Agent Spec version 26.1.0.

The Agent Engine enables workflows to combine supported LLM invocations with database operations. It coordinates Flow steps that invoke PL/SQL tools, supply that information to an LLM, and transfer the model result to later workflow components. For Agents, it coordinates iterative model-and-tool processing using the tools available to the Agent.

The Agent Engine validates each Agent Spec before execution. Its integration with Oracle AI Database brings agent execution together with the database capabilities that protect data and support reliable operation.

The DBMS_AI_AGENT package provides the public APIs for executing an Agent Spec directly or storing it under a name for repeated execution. Users can also list, describe, execute, and delete stored definitions and request structured trace information during execution.

How Oracle AI Database Agent Engine Executes an Agent Spec

When an application submits an Agent Spec and its input JSON, Oracle AI Database Agent Engine:

1. Parses the Agent Spec JSON.
2. Validates supported components, references, paths, and input and output contracts.
3. Executes a Flow from its StartNode or coordinates the supported iterative processing of an Agent.
4. Coordinates nodes, Agents, Tools, and intermediate values according to the definition.
5. Returns output JSON and, when requested, a structured trace.

A basic Flow begins at a StartNode, follows declared control paths, transfers values through data-flow edges, and completes at an EndNode:

Description of the illustration Flow Execution and Data Flow Paths

The order of fields in the JSON does not control execution. Component references link definitions, control-flow edges describe how execution moves between nodes, and data-flow edges describe how values move between them.

Advantages of Oracle AI Database Agent Engine

Advantage	Result
Governed information flow	Privileged computation and permitted disclosure remain separate.
Agent-data locality	Data-intensive work stays close to database data.
Consistent execution context	Database operations follow the applicable transaction and isolation semantics.
Supported resumability	Recoverable executions can continue from a managed boundary where available.
Simpler deployment	Data-centric workflows can run without an additional orchestration service dedicated to them.

Governed Information Flow

Agent workflows often need privileged information to calculate a result, but the model or calling application does not always need the underlying values. Oracle AI Database can keep privileged computation inside trusted database operations and pass only the permitted result to later workflow components.

Compute and Disclose Are Separate Decisions

Database privileges govern access to source data, while execution privileges govern whether a workflow can invoke a trusted database operation. The operation's output contract and the declared data-flow connections specify which results are available to later workflow components. This separation allows protected data to support a trusted computation without requiring the underlying values to pass to a model or calling application.

Consider a credit decision in which a trusted database tool can access these values:

Credit score:        612
Outstanding balance: $1.83 million
Fraud probability:   23%

The tool evaluates the protected data and produces a smaller decision contract for the model:

credit_decision         = CONDITIONAL_APPROVAL
permitted_payment_terms = NET_15
maximum_discount        = 3%
customer_message_code   = DEPOSIT_REQUIRED

The model receives the information needed to continue the workflow without receiving the credit score, balance, or fraud probability.

The same separation applies to the calling application. During execution, the Agent can use the permitted intermediate results to decide what to do next, invoke another trusted tool, or prepare a customer response. Protected source values do not need to become application outputs.

For example, the Agent can use the decision contract to prepare an approved response, while the application receives only the values mapped to the top-level output contract:

{
  "credit_decision": "CONDITIONAL_APPROVAL",
  "permitted_payment_terms": "NET_15",
  "customer_message": "A deposit is required before the order can be processed."
}

The application does not receive protected source data or other intermediate values unless the workflow explicitly maps them to its output.

Description of the illustration Protected Data Handling During Execution

This process provides an end-to-end information-flow boundary. Deep Data Security and database privileges govern access to source data. Trusted tools perform privileged computation. Oracle AI Database Agent Engine routes intermediate state, and disclosure controls determine what later components and callers receive.

In-Database Orchestration and Data Locality

Subsequent in-database workflow steps can consume results from database tools without first transferring them to an application-tier orchestrator.

This approach particularly benefits workflows that invoke several database tools or produce large intermediate results. Intermediate values can remain close to the source data. The workflow also avoids the accumulated latency and data-transfer overhead of repeated network round trips between the database and an external orchestration service.

In measured workflows, Oracle AI Database Agent Engine orchestration accounts for less than 5 percent of total execution time. Tool and LLM calls account for most of the execution time, allowing applications to use a managed agent runtime within Oracle AI Database with minimal additional orchestration overhead.

Calls to external model providers still cross the database network boundary. The workflow should send only the values required for each model invocation.

Execution Integrity

Execution integrity concerns whether workflow operations follow the applicable database transaction semantics and whether supported work can continue safely after a failure.

Resumability and Conversations (coming in 23.26.4.2)

For execution modes that support resumability, runtime-managed progress can provide a continuation point after a recoverable failure. Execution can continue from a supported boundary without requiring the application to reconstruct the entire workflow or repeat every completed step.

A durable conversation retains its identifier and accumulated message history across turns. An execution waiting for input can resume with a new user message, and applications can retrieve the persisted conversation history.

Simpler Deployment for Data-Centric Workflows

A data-centric Agent Spec workflow can execute through Oracle AI Database without requiring a separate orchestration service solely for that workflow.
The database becomes an additional Agent Spec execution target alongside any other supported runtime.

This model reduces the number of services needed to coordinate database data, stored procedures, credentials, transactions, and agent execution. Agent Spec remains the portable workflow definition, while Oracle AI Database Agent Engine supplies the execution environment for work centered on database capabilities.