“Now that AI works, what are we going to do with it?”
That was the question behind Oracle CEO Clay Magouyrk’s keynote on Day 2 of Oracle AI World 2026 in Las Vegas.
The previous day’s announcements, including Oracle Fusion Claw, focused on what AI agents can accomplish inside enterprise applications: investigating problems, optimizing operations, and executing complex workflows.
But giving AI agents more autonomy introduces new questions. How do you control what they can access? Who approves their actions? How do you find vulnerabilities before attackers exploit them? And how do agents understand the business context behind the data they use?
On October 27, Oracle introduced several capabilities addressing these challenges, including Oracle AI Security Mesh, new identity and access controls, and major updates to Oracle AI Data Platform.
Here’s a closer look at the announcements.
1. Oracle AI Security Mesh: Using AI to find and fix vulnerabilities
One of the biggest announcements was Oracle AI Security Mesh, a new managed security platform powered by OpenAI’s advanced cybersecurity models.
During the keynote, Clay Magouyrk described how its internal security practices have evolved as AI models have become more capable.
The company reported that it now discovers and remediates vulnerabilities in software and service configurations 10 times faster than six months earlier.
That improvement matters because AI is changing the cybersecurity landscape for both attackers and defenders. Models can analyze code, identify potential weaknesses, and investigate how vulnerabilities might be exploited.
Oracle AI Security Mesh aims to make these capabilities available to enterprise security teams.
How Oracle AI Security Mesh works
The platform is designed to support a continuous security workflow:
- Discover: Map applications, infrastructure, and potentially exposed systems across cloud and on-premises environments.
- Investigate: Use specialized AI models to analyze code, configurations, and possible attack paths.
- Validate: Test suspected weaknesses to determine whether they represent exploitable vulnerabilities.
- Remediate: Generate proposed fixes and validate their effects on application behavior.
- Deploy and verify: Apply approved changes and confirm that the vulnerability has been addressed.
During the keynote, Oracle demonstrated the platform using a hypothetical manufacturing company.
The system discovered an issue in an ordering API that could allow unauthorized access to sensitive information through another misconfigured service.
Specialized agents investigated the attack path, validated the vulnerability, and prepared a remediation plan. A coding agent then generated the necessary corrections.
An important detail is that customers approve remediation changes before AI Security Mesh applies them. Agents also operate with distinct identities, limited task scopes, and temporary permissions.
For security teams, the potential value is a shorter path from discovering a vulnerability to deploying a verified fix, with human approval and technical controls built into the process.
2. Agent identity and access: Who is actually taking action?
Another major topic was how identity management needs to evolve when AI agents begin acting on behalf of employees and business systems.
Traditionally, identity and access management focuses on human users, applications, and service accounts.
AI agents introduce additional complexity. They may need to access several systems, request permissions, perform sensitive operations, and coordinate with other agents.
Giving every agent broad access through an employee’s account creates obvious problems. It becomes difficult to determine who performed an action, which permissions were necessary, and whether the activity was authorized.
Oracle addressed this challenge through several identity and access capabilities.
Dedicated identities for AI agents
Oracle discussed agent identities within its Identity and Access Management approach, allowing organizations to distinguish agent activity from human activity.
The objective is to support large numbers of agents without relying on shared user credentials.
Each agent can operate under its own identity, making it possible to associate permissions and actions with a particular agent.
Just-in-time permissions
Agents also need appropriate limits on their access.
Rather than granting broad, permanent permissions, Oracle emphasized access that can be:
- Limited to a specific task or resource.
- Granted when needed.
- Restricted to a short period.
- Subject to additional approval for sensitive actions.
This reduces the risks associated with agents having persistent access to enterprise systems.
Biometric verification for human approvals
Oracle also introduced biometric capabilities through OCI Identity Assurance.
These can include facial recognition, voice recognition, and fingerprint verification to confirm the identity of users approving sensitive actions.
The rationale is straightforward: if an AI agent requires human approval before executing an operation, the organization needs confidence that the approval comes from an authorized human.
This becomes particularly relevant for activities such as releasing payments or changing access permissions.
Together, dedicated agent identities, temporary permissions, and verified human approvals establish stronger boundaries for agentic workflows.
3. Oracle AI Data Platform: Giving agents the right business context
Security controls determine what an AI agent is allowed to do. But another question remains: does the agent understand enough about the business to make an appropriate decision?
Enterprise data is distributed across ERP systems, databases, analytics platforms, documents, APIs, and external applications.
Simply making that information accessible to an AI model does not guarantee that it understands relationships, policies, or business definitions.
For example, an agent investigating an overdue invoice needs more than an invoice amount and due date.
It may also need to understand payment terms, customer relationships, approval rules, disputed transactions, and the relevant financial processes.
During the keynote, Oracle announced new AI-generated business ontologies within Oracle AI Data Platform.
What are business ontologies?
Business ontologies define the concepts, entities, relationships, and rules that give enterprise information its meaning.
They help agents understand how different pieces of business information relate to each other and how those relationships affect decisions.
Oracle’s AI Data Platform uses an AI Discovery agent to analyze information such as database schemas, application documentation, semantic models, APIs, and enterprise documents.
It can then propose business ontologies that domain experts review, refine, and approve.
This human-governed approach is important because the business remains responsible for defining what its information means.
Semantic reasoning and reusable business knowledge
Oracle also introduced capabilities built around its Semantic Reasoning Engine.
The engine uses enterprise ontologies to assemble relevant business context before information reaches the AI model.
This helps agents interpret business relationships, retrieve information across systems, and apply consistent definitions.
Reusing this context may also reduce repetitive reasoning and unnecessary token consumption.
For enterprises deploying multiple AI agents, the broader opportunity is to build a shared layer of business knowledge rather than requiring every agent to interpret the organization’s data independently.
4. Governing an expanding enterprise AI environment
As organizations deploy more agents, governance becomes increasingly difficult.
Different departments may create agents for finance, HR, procurement, operations, and customer service. Each agent may use different tools, data sources, permissions, and models.
Without a centralized inventory, companies can lose visibility into what agents exist, who owns them, and what they are allowed to do.
Oracle announced several AI Data Platform governance capabilities to address this challenge.
Oracle AI Registry
Oracle AI Registry is intended to maintain a centralized inventory of enterprise AI components, including:
- AI agents and their owners.
- Tools, skills, and MCP servers.
- Versions and dependencies.
- Permissions and lifecycle status.
This provides a foundation for understanding which AI capabilities are deployed and how they are connected.
Oracle AI Governance and Control
Oracle also outlined planned governance capabilities for testing, policy assessment, and production monitoring.
These are designed to help organizations evaluate agent behavior, quality, performance, usage, and costs.
That includes identifying unexpected behavior and supporting corrective actions as AI systems evolve.
The distinction between announced capabilities and their availability matters here: Oracle said the new AI Data Platform capabilities are expected to become available over the next 12 months.
For enterprise teams, the announcement points toward more centralized oversight of agents, their dependencies, and their operating costs.
5. Sam Altman on AI security: Why companies need to act now
Another highlight of the keynote was the conversation between Clay Magouyrk and OpenAI CEO Sam Altman.
The discussion covered AI-assisted software development, the accelerating capabilities of AI models, and the implications for cybersecurity.
Altman emphasized the importance of understanding the changing AI security threat landscape and addressing emerging risks.
One point from the discussion is particularly relevant: AI is becoming capable of discovering vulnerabilities that may have existed in software for years.
This creates an advantage for organizations that use those same capabilities defensively.
The challenge is that vulnerabilities can be discovered at a pace that traditional manual investigation and remediation processes may struggle to match.
That makes automated security testing, validation, and remediation increasingly important.
It also helps explain Oracle’s approach with AI Security Mesh: using advanced AI models to strengthen the systems that other AI agents and business applications depend on.
What these announcements mean for Oracle customers
Together, the Day 2 announcements address several practical requirements for enterprise AI adoption.
Security: Organizations need ways to identify and remediate vulnerabilities across the systems their agents interact with.
Identity and permissions: Agents need identifiable ownership, limited access, and appropriate human approvals.
Business context: Agents need to interpret enterprise information according to the relationships, definitions, and processes that govern the business.
Operational governance: IT teams need visibility into deployed agents, their dependencies, behavior, and costs.
These capabilities are especially relevant for companies expanding their use of Oracle Fusion Applications, OCI, Oracle databases, and third-party enterprise platforms.
They also complement the capabilities introduced with Oracle Fusion Claw.
As agents take on more complex responsibilities, the supporting architecture becomes increasingly important. Data integration, identity management, security testing, business semantics, and monitoring all influence how reliably those systems can operate.
Bringing governed AI into your Oracle environment
At Inclusion Cloud, we’re an Oracle Partner with more than 20 years of experience supporting Oracle implementations, integrations, optimization, and specialized IT staffing.
Whether you’re evaluating new AI capabilities, connecting enterprise data, or expanding your Oracle delivery team, our specialists can help you plan and execute your next steps.
