Oracle’s latest announcement of new agentic AI capabilities in its AI Database highlights a shift that is becoming central to enterprise security. As AI systems begin to act autonomously on enterprise data, the key challenge is no longer generating answers but controlling how those systems access and use that data. This is a fundamental change in where trust must be enforced. Traditional security models assume predictable behavior, human intent, and clearly defined application boundaries. Agentic AI breaks all three assumptions.
Oracle’s response is to move control closer to the data itself. By embedding access controls, execution, and AI capabilities directly into the database, the approach addresses both the risks and operational complexity introduced by autonomous systems.
Large language models are powerful tools, but they generate responses based on probabilities, not facts. This is why a Zero Trust mindset for AI makes sense. Every output must be treated as unverified information and validated accordingly, as discussed in my earlier publication, Using Generative AI at Work.
With agentic AI, however, the risk shifts even further. The issue is no longer just incorrect answers but incorrect or unintended (and often disruptive) actions. An AI tool that produces a misleading summary is inconvenient, but an agent that generates and executes a query against sensitive enterprise data is a security incident or potentially a major operational risk.
When Agents Become Insider Threats
AI agents operate in a fundamentally different way from traditional software components. They are given goals, access to tools, and often broad permissions to explore and interact with enterprise systems. In practice, this means they behave less like applications and more like autonomous privileged users.
This creates a familiar but amplified risk. As my colleague Jonathan Care points out in Your AI Agent Just Became an Insider Threat, agents frequently act within allowed boundaries, which makes their actions appear valid even when the outcome is not intended. The access is legitimate, but the intent is no longer predictable.
What makes this particularly challenging is that nothing appears obviously wrong at the technical level. The queries are valid, the access is authorized, and the systems respond exactly as designed. And yet, the outcome can still violate policy, intent, or business logic. This is sometimes framed as agents “going rogue.” But there is usually no malice involved. The real issue is that they optimize for what is specified, not for what is meant. When intent is insufficiently defined or guardrails are weak, perfectly compliant behavior can still produce undesirable or even risky outcomes.
The Limits of Application-Level Control
A common pattern in enterprise architectures is to enforce data protection at the application layer. Applications implement business logic, apply access controls, and expose only the data that users are supposed to see. The database, in contrast, often plays a more passive role, enforcing coarse-grained permissions.
This model works reasonably well when interactions are predictable and tightly controlled. It assumes that users follow predefined workflows and that applications act as reliable intermediaries between users and data. For years, this was good enough.
Agentic AI breaks this model. Agents do not necessarily follow predefined or predictable execution paths but generate queries dynamically, combine multiple data sources, and adapt their behavior based on context. To complicate matters even further, controls are not applied uniformly across applications, increasing agentic risk.
As explored in Why We Need to Rethink Data Access with Agentic AI by Jonathan Care, traditional access models were never designed for autonomous entities operating with fluid intent. The result is a growing gap between where data is secured and where it is actually accessed.
Eliminating this gap requires moving security controls closer to the data itself.
Building Trust into the Data Layer
This is where a data-centric approach to agentic AI becomes a must. Instead of treating the database as a passive storage system, it becomes an active control point for both data and AI interactions.
Oracle’s approach reflects this shift. Rather than building separate pipelines to move data into AI systems, the architecture keeps data, AI processing, and access controls directly within the database. This reduces the need for data movement and complex workflows while enforcing policies consistently.
Security controls can therefore be applied directly where the data resides. Capabilities such as Oracle Deep Data Security allow organizations to define fine-grained policies down to the row, column, and cell level. When agents generate queries dynamically, these controls are enforced consistently, regardless of how the query was created or which agent initiated it.
Enterprises are increasingly moving AI capabilities closer to where their data already resides. This is done not just for performance or faster deployment, but also to reduce architectural complexity and limit unnecessary data movement. For agentic systems, constantly traversing multiple databases and services introduces cost, latency, and additional exposure points. The more fragmented the data landscape, the harder it becomes to control how agents access, combine, and act on that data.
Consolidating data and AI processing within a unified platform can mitigate these issues. Oracle positions its AI Database as such an environment, supporting multiple data types and enabling in-place processing to avoid data replication and egress. At the same time, agentic workflows benefit from the database’s existing security model, including fine-grained access controls, encryption, and monitoring.
At the same time, the execution environment for AI can be contained. Oracle Private AI Services Container enables organizations to run models in isolated, private environments. This reduces the need to expose or share sensitive data with external services and allows enterprises to maintain control over how data is processed, particularly in regulated environments.
Bringing these elements together also simplifies the overall architecture. Agent memory, vector search, transactional data, text, graphical, and analytical workloads can coexist within the same platform. This reduces fragmentation and helps ensure that data access policies are applied uniformly across different layers of the system.
From Answers to Actions
Agentic AI is all about enabling systems to act autonomously and intelligently, achieving an unprecedented level of flexibility and independence. Agents interpret requests, break them into tasks, and execute workflows across multiple agents and systems.
This shift increases both the value and the risk of AI. On the one hand, organizations can automate complex processes and respond to real-time events. On the other hand, they now must deal with systems that act with a degree of autonomy that is very difficult to predict.
To address this, it becomes important to balance flexibility with control. Oracle AI Database Private Agent Factory provides a structured environment for building and deploying data-centric agents. By defining workflows explicitly and integrating them with database capabilities, organizations can introduce more determinism into systems that would otherwise be highly dynamic.
This does not eliminate uncertainty, but it helps constrain it. This kind of structure is essential for moving from experimentation to production, where consistency, auditability, and compliance become critical.
Toward a Data-Centric Model of Agentic AI
The emergence of agentic AI makes one thing clear. Security can no longer be treated as an external layer wrapped around applications. When autonomous systems are given direct access to enterprise data, trust must be enforced right at the source. A data-centric approach aligns data access, security, and AI execution within the same platform. Fine-grained access control, controlled execution environments, and integrated data services become essential foundational capabilities.
Oracle’s recent enhancements in its AI Database illustrate how this model can be implemented in practice. By embedding trust directly into the data layer and combining it with integrated AI capabilities, the platform addresses key challenges that organizations are beginning to face as they move to adopt agentic AI at scale.
In the paper I wrote last year after attending Oracle AI World, I compared the company’s AI strategy to a car race. It is also worth remembering that in Formula 1, engineers do not rely on the driver alone to stay within limits. Control is built into the car itself through telemetry, constraints, and constant feedback. Agentic AI introduces a similar reality. Relying on agents to behave correctly is not enough. Access controls must be built into the system, and in practice, that means building it where the data resides.
In this sense, Oracle AI Database represents the next step in a journey KuppingerCole Analysts has been tracking through more than a decade of Leadership Compass research, bringing data-centric security directly into the era of agentic AI.
