{
  "video": {
    "id": "LnQce-eHm8k",
    "title": "Your AI Agent Wants Your Data. Here's How to Lock It Down - Jeff Smith, Oracle",
    "duration": 1300,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "LnQce-eHm8k",
    "title": "Your AI Agent Wants Your Data. Here's How to Lock It Down - Jeff Smith, Oracle",
    "one_liner": "Don't let business users rely on raw natural-language-to-SQL. Expose curated, parameterised reports through an MCP server as just two tools (list reports and execute report), give agents read-only access to a standby copy, and enforce identity-based security inside the database, not in the tools.",
    "summary": "Jeff Smith says agents thrive on data, and most enterprise data lives in databases, so the question is how to give agents that data without leaking PII. He argues natural language to SQL is \"amazing, but dangerous\": LLMs often write queries that return plausible-looking but wrong data, and they burn tokens brute-forcing the schema. He covers Oracle's alternatives. These are curated report tools, read-only agent access to a Data Guard standby, compressed schema-info and annotation tools for context engineering, and \"deep data security\". That last one passes the user's SSO roles to the database, which strips rows the user isn't allowed to see from results before the agent gets them.",
    "key_points": [
      "Oracle AI Database stores vectors (plus relational, graph and other data types) alongside the data in one instance with a single SQL interface. You don't copy data to eight or nine platforms for RAG, and one MCP server covers all of it.",
      "Natural language to SQL is risky because LLMs often run queries that seem to return the right data but don't, and the business users asking can't spot a bad cross join. It is also expensive, because agents brute-force the dictionary to find data.",
      "Existing team reports (from SharePoint or network drives) can be loaded into the database or MCP server as parameterised, hard-coded queries with descriptions and sample questions. Two tools, list reports and execute reports, cover them all, so 500 reports doesn't mean 500 tools blowing out the context. The LLM can still pick the wrong report, but it can't write the wrong SQL.",
      "Oracle's MCP servers can run arbitrary ad-hoc SQL and stored procedures, but that can be turned off to limit agents to custom tools and reports. With the right OAuth 2 scope or role, the tool will also show the agent the SQL behind a report so it learns the data model and has a better chance of one-shotting its own queries.",
      "For DevOps and performance work, he doesn't trust an LLM to drop or even build an index. He wants advice he then acts on, keeps agents out of production where possible, and points them at a read-only Data Guard standby. His custom performance tool has six allowed actions, including collecting optimizer statistics and generating AWR reports. He prefers three or four cross-category tools with options over 15 single-use tools.",
      "The schema info tool returns a compressed JSON dictionary in verbose, slim or medium modes with keyword filtering, instead of the agent querying every table, column and comment and sampling rows. The retrieve context and generate annotations tools pull text from SharePoint PDFs, PowerPoint, Excel and Word files and store it back in the database as plain-English annotations, illustrated with his annotated Strava workout table.",
      "Deep data security: agents don't log in with database authentication. Users go through the organisation's single sign-on (e.g. Azure AD), which returns scopes and roles, and when generated SQL runs, the database strips data the user isn't allowed to see from the result set before it reaches the agent.",
      "Roadmap: MCP apps (database GUI inside the agent) coming later this year, skills delivered via tools, and automated RAG pipelines (CLI ingestion plus an MCP tool that returns vectors and snippets). More at oracle.com/mcp."
    ],
    "takeaways": [
      "Before relying on natural language to SQL, turn your existing trusted reports into parameterised tools, each with a description, input definitions and sample questions, behind one list tool and one execute tool.",
      "Enforce security at the database layer, tied to the user's SSO identity and roles, so an engineer pointing a different tool at the database can't bypass it.",
      "Give agents read-only access to a standby or replica instead of production. Expose a small set of multi-action tools whose allowed actions you have vetted, and have the agent give advice that a human acts on.",
      "Do the context engineering up front: annotate schemas (cryptic table names, units, columns that don't hold what you'd expect) in plain English inside the database, and serve compressed schema metadata, so agents don't keep reverse-engineering the database and humans benefit too.",
      "Consider switching off arbitrary SQL execution in the MCP server for business users, and only show report SQL to sessions with the right OAuth scope."
    ],
    "topics": [
      "mcp",
      "text-to-sql",
      "database-security",
      "context-engineering",
      "agents",
      "rag",
      "token-optimization",
      "vector-search"
    ],
    "tools": [
      "Oracle AI Database",
      "Model Context Protocol (MCP)",
      "MCP apps",
      "Claude",
      "Codex",
      "Gemini",
      "LangChain",
      "Excel",
      "BI Publisher",
      "Oracle Data Guard",
      "AWR",
      "Oracle cost-based optimizer",
      "OAuth 2",
      "Azure AD",
      "SharePoint",
      "Confluence",
      "Strava"
    ],
    "quotes": [
      {
        "text": "So, the LLM might screw up by picking the wrong report, but the LLM's not going to screw up by generating the wrong SQL.",
        "at": "09:25",
        "url": "https://www.youtube.com/watch?v=LnQce-eHm8k&t=565s"
      },
      {
        "text": "So, I could have 500 reports, that's not 500 tools.",
        "at": "09:47",
        "url": "https://www.youtube.com/watch?v=LnQce-eHm8k&t=587s"
      },
      {
        "text": "but for me, the best place to always implement security for the database is where? At the database.",
        "at": "13:11",
        "url": "https://www.youtube.com/watch?v=LnQce-eHm8k&t=791s"
      },
      {
        "text": "but now that AI is a thing, we can't let the poor bots suffer.",
        "at": "16:45",
        "url": "https://www.youtube.com/watch?v=LnQce-eHm8k&t=1005s"
      }
    ],
    "words": 4253
  },
  "summary_url": "/#LnQce-eHm8k",
  "transcript": {
    "html": "/transcripts/LnQce-eHm8k.html",
    "txt": "/transcripts/LnQce-eHm8k.txt",
    "vtt": "/transcripts/LnQce-eHm8k.vtt"
  }
}