Oracle wants the database, not the AI agent, to enforce your security rules

Oracle has introduced its Deep Trust AI Architecture at its AI World event in Las Vegas. It is a blueprint that moves security, privacy and business rules out of agents and applications and into the database and runtime.

The pitch is that an AI agent should not have to get every safeguard right, because the layers underneath enforce them. Oracle says the design covers four layers: the software platform, the data, data access and application development.

Four layers, each with its own enforcement point

Oracle describes the architecture as a package of existing and new capabilities across Oracle AI Database, Oracle Autonomous AI Database and the Oracle APEX AI Application Generator. The company compares it to its Maximum Availability Architecture, a blueprint for keeping systems running.

At the platform level, Oracle says Autonomous AI Database applies security updates automatically across the database engine, operating system, storage and firmware, and does so before the fixes are public. Patching is rolling, so applications keep running. Encryption is always on for data at rest and in motion. Oracle says the service is available on leading hyperscalers and on-premises through Oracle Cloud@Customer. Customers who run co-managed or on-premises systems can get Oracle’s security and patching tools free or at a steep discount through the end of February 2027.

At the data level, Oracle Deep Data Security lets organizations define end-user access rules inside Oracle AI Database and apply them to every SQL request. The database checks the user’s identity from a cryptographically signed token issued by the corporate directory. Oracle SQL Assertions add business rules, such as blocking a charge above an employee’s spending limit, whichever application, person or agent submits it.

At the access level, Deep Trust Data APIs give applications and agents read and write access to logical business objects such as purchase orders, rather than open SQL. Oracle Deep NL2SQL adds business terminology, practices, metrics and data definitions to natural-language questions. Two features handle corrections: Continuous Feedback Learning lets users flag wrong answers, and Knowledge Change Verification validates fixes before they enter the corporate knowledge base.

At the application level, the APEX AI Application Generator has AI coding agents turn plain-language descriptions into APEXlang, an open, declarative definition language. APEX runs those definitions in a central runtime. Because the AI writes only the definition and not the code that executes it, Oracle argues companies avoid securing large volumes of generated code. Developers can work in VS Code, Oracle APEX or any AI coding agent, and Oracle names Codex as an example.

Juan Loaiza, executive vice president of AI Database Technologies, said in the announcement: “AI trust is the biggest challenge we face today.”

What changes for teams already running agents

The practical shift is where the rules live. Today, many teams that connect an agent to a database through an MCP server or a natural-language-to-SQL tool rely on the application layer to filter what comes back. Oracle’s own description of the problem is that such code can be written wrongly, or skipped when an agent queries the database directly. Under Deep Trust, the database would refuse the request itself.

The announcement does not give a general availability date or pricing for Deep Data Security, Deep Trust Data APIs or Deep NL2SQL. It also does not say which of the pieces are shipping today and which are still being rolled out, beyond calling them “proven capabilities.” The only dated offer is the free or discounted security tooling, which runs to the end of February 2027. The accuracy gains Oracle attributes to Deep NL2SQL come with no benchmark, and the quoted endorsement comes from an analyst firm, HyperFRAME Research, whose CEO Steven Dickens is quoted in the release.

A different bet from Nvidia’s hardware approach

Oracle is not alone in arguing that agents cannot be trusted to police themselves, but it puts the enforcement point in a different place than its rivals. Last week Nvidia published its OpenShell Reference Architecture, which we covered in Nvidia moves AI agent security from software into the chip. Nvidia’s design wraps the agent in a sandbox with a supervisor that checks outbound requests against policy, and offers an optional hardware layer, Sentry, on BlueField-4 DPUs in a separate trust domain. Nvidia says that layer can quarantine a misbehaving agent within milliseconds; that figure is Nvidia’s own and has not been independently tested.

The two approaches guard different things. Nvidia’s controls what an agent process can do on a machine and the network: files, processes, outbound calls. Oracle’s controls what data an identity can read or change once the request reaches the database. They are closer to complements than substitutes, and Oracle Cloud Infrastructure is among the cloud partners Nvidia lists for OpenShell. A company running agents on OCI could in principle use both, though neither vendor has published a joint design.

There is also a commercial angle. Oracle has just committed $1 billion over four years to its partner network, as we reported in Oracle sets aside $1 billion over four years to win partners for its AI push. A blueprint that integrators can sell and implement fits that push, and it ties AI security to Oracle’s database and APEX products. Rule enforcement in the database also means the logic is tied to one vendor’s engine, a trade-off Oracle’s release does not discuss.

What the announcement leaves unproven

Everything about effectiveness in the release is Oracle’s own claim. The company gives no test results showing that Deep Data Security stops an agent from reaching restricted rows, nor figures for the performance cost of checking every SQL request against identity-based rules. It does not say how the architecture handles agents that act through non-Oracle databases, which many enterprises run alongside it.

The release points to a technical blog and analyst commentary for further detail, which are the places to look for supported versions, licensing and any limits. Until those details appear, Deep Trust is best read as a statement of architecture and direction, with the free patching tools to February 2027 as the one concrete offer.