Your AI Agent Wants Your Data. Here's How to Lock It Down - Jeff Smith, Oracle
https://www.youtube.com/watch?v=LnQce-eHm8k
AI Engineer · 21 min · 253 sentences · sentence-level transcript from YouTube's caption track; each line begins at the time shown

[00:01] [music]
[00:12] I'm Jeff.
[00:13] I'm from Oracle.
[00:14] I'm almost
[00:15] [snorts]
[00:15] the exact same age as Oracle.
[00:17] Does anyone know what year Oracle was founded?
[00:22] Same year Star Wars came out.
[00:25] Yeah.
[00:26] Um and I've been working with database tools um for about 25 years.
[00:33] And I learned a truth very early on that no matter how good of a tool you build, at the end of the day what people want are Excel spreadsheets.
[00:41] Is that still true?
[00:43] Has the agent killed Excel yet?
[00:48] Well, they published the reverse engineer anything, right?
[00:50] And then they immediately reverse engineered Excel.
[00:52] So, maybe Excel's still a thing.
[00:55] Um the biggest question we've got at our booth and from random people on the street that see my Oracle jacket, other than can I have your jacket, um is like what is the Oracle AI database?
[01:06] So, who in here has worked with or studied or seen an Oracle database before?
[01:12] Who in here is currently using Oracle?
[01:16] Cool.
[01:16] Thank you.
[01:17] Um so, what's an Oracle AI database?
[01:20] Well, the only real way to answer this question today is to ask Claude.
[01:25] Um my agent's very well trained and behaved.
[01:28] So, it actually had a pretty good answer.
[01:31] The nutshell is the database is now able to participate in all of your rag pipelines because we natively support vectors inside the database.
[01:41] So, if you've got financial data, HR data, ERP, shipping, um retail, government, healthcare, whatever, if you want to look for information in that data warehouse, that data lake, that data sewer, that
[01:58] beautifully curated database.
[02:00] We can vectorize your information alongside the data inside the database, and we give you a single SQL interface across all of that.
[02:09] So, you don't have to replicate data across eight or nine different platforms just for your Did you see that?
[02:17] That was like Spider-Man.
[02:19] Um So, that means one MCP server um into the database, and I'm here to talk about MCP.
[02:31] So, um just see Oh, missed it that time.
[02:37] It's not just vector that we've added to the database.
[02:40] So, in addition to your relational tables and columns, thank you so much.
[02:43] Would you like a complimentary pair of socks?
[02:47] Yeah.
[02:47] [laughter]
[02:49] Feel like you should have won a prize for that.
[02:51] Um Yes, thank you.
[02:55] For 30 years, we've been adding um data types and data workloads to the database.
[03:01] So, we support all of these things.
[03:03] Um also, graph.
[03:04] So, if you're a fan of graph rag, um we can do that as well inside the single instance of Oracle.
[03:11] So, people like to dig on Oracle cuz we're old, that doesn't mean we've stopped innovating.
[03:16] I mean, we we're inventing, building, publishing new stuff uh every month.
[03:21] We have to because people are giving us lots of money, they expect value in return for that.
[03:28] All right.
[03:28] So, what I want to actually talk about today MCP, we're going to cover some uh real-life use cases cuz that's the biggest question I get is like agents, LLMs,
[03:39] MCP great, who cares about databases?
[03:41] Like, what what's the point here?
[03:42] It And for me, it's very obvious.
[03:44] I mean, like all of your data, information, knowledge is inside a database, and the agents thrive on on data.
[03:50] So, how can we get that information to them safely without bringing the company down because we've leaked PII or done something horrible and end up in front of Congress testifying about it.
[04:02] I want to talk about uh the advancements that we're pushing.
[04:05] You know, MCP is brand new protocol, but they add stuff almost every 3 months.
[04:09] So, Oracle is there having these conversations with the board and we're trying to pick up the new features as they come out.
[04:18] And we don't have time for Q&A today, but I do I did bring some swag.
[04:23] I think most of it's gone.
[04:24] If you want a bag or socks, oh, we have some DB stuffies in the back.
[04:28] We can throw those at you.
[04:31] Um I'll share some roadmap stuff as well.
[04:36] So, this is an hour talk and I was told I have 20 minutes and then not really just 18.
[04:41] Let's see how fast we can go cuz I've wasted 2 minutes on the podium.
[04:45] All right.
[04:47] So, the three things I want you to be able to walk away with, what we've built, um the problems with natural language to SQL, and some things that we're trying to make that more trustworthy,
[04:59] and then anything I can share with you folks that might help with token optimization.
[05:07] All right, use cases.
[05:09] I think this is the last use case that businesses end up undertaking, but I also think it is the biggest return for your buck.
[05:18] Um generally the people managing the infrastructure around the database are the ones that get to hook up the new technology.
[05:25] So, when I say, "Hey, do you want to try an MCP server?"
[05:29] It's usually a database administrator, a network administrator, a sysadmin, a DevOps engineer that's going to have the ability to do that in the first place.
[05:37] So, they'll use these tools to make their lives easier.
[05:41] But if you look in a company, there are way more of these types of people, the people that get the questions from the SVP, the EVP, God forbid the CXO
[05:52] saying, "How many widgets did we sell last month?
[05:56] How are we performing in this region?
[05:58] Um what discount rate should we run to maximize um people closing out their carts?
[06:04] All all that fun stuff that I pretend to understand."
[06:07] And so, what generally what happens, they go into their BI Publisher, they go into their data marts, they they start building their spreadsheets, they they pop out the answer, and that ends up in a
[06:18] in a meeting somewhere, and someone makes very important decisions based on the pivot tables and Excel spreadsheets that have been compiled.
[06:26] And these questions are endless.
[06:30] Like it's not that people run out of questions [clears throat] to ask.
[06:33] They don't have enough time and people to answer those questions.
[06:37] Like every second there's like, "Oh, there's What if we try this?
[06:39] What if we try that?"
[06:41] So, the beauty of generative AI is like it's a force multiplier, right?
[06:45] So, we had now have the time and the resources to ask these endless questions.
[06:51] The problem is the data's in the database, and the people putting together these spreadsheets,
[06:57] [snorts]
[06:58] they're not necessarily SQL experts, data model architects.
[07:03] They understand the business, but they wouldn't recognize that a cross join doesn't make sense for this scenario.
[07:09] So, natural language to SQL is amazing, but I think it's dangerous.
[07:15] Have you ever heard the phrase, "If it compiles, ship it?"
[07:19] Engineers laugh about this.
[07:21] We pretend to laugh along.
[07:23] Um I wrote a SQL query, data came back.
[07:26] Awesome, I got it right.
[07:27] No. You didn't actually ask what you thought you asked.
[07:30] The LLMs are going to frequently run queries that look like they're returning the right data, but they're not.
[07:35] And there are various reasons why the LLMs, although they're getting better and better at this, are still going to fall short.
[07:40] Like I would not trust Codex or Claude or Gemini or any of these two decide what business branch that we're going to invest in XYZ just based on a prompt and a and a thing that pops back.
[07:56] It's also expensive to ask them to do this stuff, too, cuz they're going to brute force your dictionary your your database looking for the right data to answer these questions.
[08:04] So, not only is going to be unreliable and the people using this these tools don't necessarily understand what the the agents and MCPs are doing on our behalf, but it's going to take a lot of tokens and time
[08:15] to get that data.
[08:16] So, one of the things we've done at Oracle is said, "Hey, as a business, as a team, as a group, you've got a SharePoint, you've got a network drive, you've got something where there's
[08:27] folders and folders and folders of reports that you've compiled over the years.
[08:32] And these are the things that you look at when people ask these questions.
[08:36] So, why not find a way to pipeline them into the database and/or MCP server and present those almost as like tools or APIs that the agent can call.
[08:48] So, instead of the agent tasking an LLM to generate a query, you say, "Hey, these are the reports available to you.
[08:55] Which of these would you like to look at?"
[08:58] So, that's what we've done at Oracle.
[09:00] We allow you to take as many of these as you want.
[09:03] Now, you do have to put some time into this.
[09:06] You'll need to describe the reports and I like to include like, "Hey, here's sample questions."
[09:12] You know, the agent can say, "Hey, if you got a question about this, this is a good report to run."
[09:16] I describe what the report means.
[09:17] I describe all the inputs, so of course they're parameterized.
[09:21] But, the code underneath the report is more or less hard-coded.
[09:25] So, the LLM might screw up by picking the wrong report, but the LLM's not going to screw up by generating the wrong SQL.
[09:32] So, it's just one less plus place it can mess up.
[09:37] Now, in terms of MCP tools, I present I present a tool called list reports and execute reports.
[09:47] So, I could have 500 reports, that's not 500 tools.
[09:51] That would That would blow out context and then agent would be like, "This is This is too much.
[09:56] This isn't useful."
[09:58] So, when I ask a question, it can say, "Using this key phrase, give me any report that looks like this."
[10:03] I'll get a report list back and then I can execute one of those reports to get the data back.
[10:08] This is an option above natural language to SQL.
[10:12] So, our MCP servers definitely support taking arbitrary ad-hoc SQL stored procedure code and executing it on the fly against the database, but they also support turning that off and limiting you to custom tools
[10:26] and reports.
[10:28] And there's another mode for the context engineers out there.
[10:32] These reports represent like the blueprint for how the the business works, for how the data model works.
[10:37] So, if you have the proper scope or role in your OAuth 2 authenticated session, the tool will also offer to show the agent the SQL behind the report.
[10:49] So, it can learn how your data is organized in the system and then it's going to have a much better chance at one-shotting the right query when it goes to generate it.
[10:59] So, you're basically say, "Here's some markdown explaining how we find out the number of widgets we sold last month."
[11:08] And of course, here comes the results back and our agent nicely formats that.
[11:14] Who in here started playing with MCP apps?
[11:19] Yeah.
[11:20] So, that was I think you're introduced in the spec in July.
[11:22] That's something I'm going to talk about later on, like 5 minutes based on this little clock.
[11:29] Um Okay.
[11:31] Use case number two.
[11:33] So, for DevOps engineers, support folks, our platform is very well known.
[11:38] It's been around for a long time.
[11:40] The docs, the PDFs, the GitHub projects, the Stack Overflow questions, my blog posts, they're all out there.
[11:46] The LLM's been trained on it.
[11:48] They know what to look at if a query is slow.
[11:50] But, I don't trust an LLM to drop an index, to build an index even, to do anything in the database for me.
[12:01] I want it to give me advice and then I'll action that advice.
[12:05] And then if anything, I'm not going to let the LLM or the agent into production at all if I don't have to.
[12:11] Does that sound crazy?
[12:13] So, how do I use an agent or LLM to get help with a production system that's running slow?
[12:19] Everyone here has a test environment that mirrors production, right?
[12:24] No?
[12:28] Um we have a technology at Oracle called Data Guard that allows you to have a read-only standby instance where you can offload like reports and read-only queries to.
[12:37] So, there's a good chance your performance issue would replicate over there.
[12:41] You can have your agent go attack, not attack, that's not the right word.
[12:45] That's the right word actually sometimes.
[12:46] You can have your agent go interrogate that safer environment to investigate and try out different performance um tricks.
[12:56] So, I am looking to give the LLM's read-only access, but that's not enough.
[13:00] I also need to lock down what they can do once they're in there cuz even if you can only read the data, you might be able to read the data you don't want them to see.
[13:08] Um we can do that a couple different ways, but for me, the best place to always implement security for the database is where?
[13:18] At the database.
[13:20] If you build security only into your tools, what happens when a zealous engineer decides to go pick up another tool and point it at your database, they just go straight in,
[13:30] right?
[13:30] But if you put security at the database layer, more times than not you're going to be okay.
[13:35] The agents and LLMs are really, really good at finding and fixing performance issues.
[13:41] This is probably the easiest demo for me to do.
[13:43] I don't have time to do demo, but I've written a custom tool.
[13:47] This tool has six different actions that I'm a cool with it to do on my behalf, and one of those is to collect statistics that basically profiles the data.
[13:58] We have something called a cost-based optimizer.
[14:00] So, when you ask queries, the plans that get generated, they don't get generated based on rules of thumb.
[14:06] We look at the profile of the data, like how many unique values are in this column.
[14:11] Yada yada yada.
[14:12] The fresher and the better the statistics are, the better chance it's going to generate a good execution plan and have a good performance profile runtime.
[14:19] So, I'm not generating 15 tools that are single-use tools.
[14:24] I'll generate three or four tools that cross categories, and each of those tools have options.
[14:29] So, my agent can see, oh, here's a performance tuning tool.
[14:31] It can do six things.
[14:33] One of those is like generating uh a performance profile report.
[14:36] We have a feature called um AWR.
[14:39] I'll let it generate a report.
[14:41] One of the other things I'll let it do is is generate statistics.
[14:47] This ties in closely to the first use case, schema exploration and documentation.
[14:54] Man, I'm running out of time.
[14:56] So, natural language to SQL is really awesome.
[15:00] It's where most of the excitement around AI and databases lie, which makes sense cuz SQL's the most popular way to get stuff out of a database.
[15:09] We need that data, but it's a nightmare for a lot of these systems.
[15:14] Has anyone started a job in the last 6 months?
[15:20] Is there like a place in the break room where they put on the corner like a a diagram where all of the hard stuff is defined, all of the code words are listed,
[15:30] all of the all of the inside jokes are documented, where the data model is explained.
[15:37] Hey, our sales aren't in a sales table, they're in a table called XHR_123 because an engineer 30 years ago thought that would be cool.
[15:47] Yeah, it's a big Confluence page.
[15:50] We have tools now that will let you consume those Confluence pages and generate context and document uh schema metadata over top of the metadata that's already in your database.
[16:03] So, it's another context engineering exercise.
[16:07] We want to be able to deliver to the LLM the information about the database environment you're talking to instead of relying on it to generate queries to reverse engineer hack your database to look for data.
[16:18] It will find the data if you ask it, it'll just take a long time, and it'll look for it multiple times, and unless you have shared team enterprise memory across everyone's agents and LLMs,
[16:30] it's just a it's just just a huge waste.
[16:32] So, what we're like with for some reason it wasn't a big problem to let new employees suffer when they joined an org.
[16:41] Like it wasn't it wasn't a big enough problem to fix this issue 30 years ago, but now that AI is a thing, we can't let the poor bots suffer.
[16:49] So, we got to get them the information they need to to make it easier to use our databases.
[16:53] The The nice thing about this feature is it's all in plain English, it's in the database, it it's going to help the humans, too.
[17:03] So, when you go look at our tools, we have something called schema information.
[17:08] So, I'll say, "Hey, Codex, Claude, whatever, I've got a new um environment.
[17:14] I need you to go look into it and see how laid out, find this, and let's go summarize the information.
[17:21] It'll see that it has a schema info tool, and it'll start using that, and that returns back a compressed dictionary a set of attributes in JSON versus it running queries.
[17:33] Hey, show me all the tables, show me all the columns, show me all of the comments.
[17:38] Let's go read five rows out of each table to see if the data has what we looks like.
[17:42] You know, we just kind of built that into the tool, optimized it, and it always returns the same data, and it has multiple modes.
[17:51] You can go verbose, slim, medium, just like my pants, and uh it's got filtering.
[17:57] So, you can give it keywords, and it just looks for specific things in the data.
[18:02] [snorts]
[18:02] And then I can pull that back out with another tool called retrieve context, where I can use that information to do AI vector search, but I have another new tool called generate annotations.
[18:13] So, I can point it to that SharePoint site that you have, scan in your PDFs, your PowerPoints, your Excel, your Word docs, um and store those in um or pull the text out,
[18:26] organize it, and and put it back into the database.
[18:30] This is also it's easier to one-shot SQL queries when you have natural language to SQL exercises.
[18:39] This is what the data looks like in the database after I've properly annotated a table.
[18:44] So, anytime I do a run or a bike ride or whatever, it goes into my Strava account.
[18:50] I'm a nerd, so I have an API on that data, and I store it in my database.
[18:54] And their schema is fairly well described, but it jumps between like units of measure and time, and some of the columns don't have what you think they do.
[19:03] So, I just have that all annotated, and so when I start asking questions about, "Hey, what kind of workout should I do next week?"
[19:09] and it looks at my personal workout history, it it gets to that much easier with this with this info.
[19:15] And the nice thing about this with MCP is AI and LLM agnostic.
[19:19] It's going to work for everything as long as the MCP server and the tools are there.
[19:27] Okay, so this might be the most important thing I talk about, security.
[19:30] So, I got 40 seconds.
[19:31] We'll just end on this.
[19:33] Um we need to know who is looking at the information in the database before we return any data back to them.
[19:42] The information I'm allowed to see is going to be much different than what the data my colleague Tara is going to be able to see.
[19:48] And when I'm in the database using Claude or Codex or Gemini or my own homegrown LangChain framework, we don't use database authentication to let the agent go in and do stuff.
[19:59] We pipe you through your organization single sign-on.
[20:03] So, like Azure AD, which is going to return a list of scopes, which is going to return a list of roles that describe your role in the organization, and the database can be coded to say, "Oh,
[20:13] Jeff is an HR manager.
[20:14] He's allowed to see everyone's salary."
[20:19] But no one else outside that org can.
[20:22] So, when we the natural language questions get generated to SQL, when that SQL runs against the database, the database dynamically strips data from the result set before it comes back down
[20:33] to the agent.
[20:34] We call that deep data security.
[20:36] I'm out of time.
[20:38] I covered the big stuff.
[20:42] We thought a lot about security at Oracle.
[20:44] We want this stuff to be easy, but we want it to be safe.
[20:48] We are building MCP apps, so you can have the database interface GUI directly in your agent.
[20:54] That's coming later this year.
[20:55] [snorts]
[20:56] We have skills.
[20:58] The skills can be delivered via tools.
[21:02] We support automated rag pipelines.
[21:03] You can use a command line to suck documents in and then an MCP tool pipe the the vectors and the the snippets of the the documents back to your agents.
[21:15] And when you want to learn more about any of this stuff, we have the easiest URL oracle.com/mcp.
[21:21] I'm leaving to get on a plane to fly back to Raleigh, North Carolina, but if you find me on LinkedIn, I'm that Jeff Smith and my colleagues are down at the Oracle booth and they have more swags.
[21:28] If you missed out on the plushy, we have more.
[21:31] Thanks, everyone.
[21:32] [applause and music]