Agentic AI for Oracle AI Database practice questions

Worked examples for Agentic AI for Oracle AI Database

1. Question 1

   A bank builds an in-database agentic assistant on Oracle Database 23ai. The agent answers questions by running **AI Vector Search** similarity queries over embeddings stored in a vector column on the `LOAN_APPLICATIONS` table, then calls a PL/SQL procedure to update an application's status. Each end user connects with their own database account, and the table is protected by existing privileges and row-level policies. The compliance team asks how the agent's retrieval and actions will be governed. Which statement best describes how governance applies to this workflow?

   1. A. Because embeddings are numeric vectors rather than readable text, similarity search over them falls outside the database's access control and needs only network-level protection.

      Treats governance as purely a network/perimeter concern and assumes vectors are not real data. Vectors are a native column data type in ordinary tables, so reading them is a normal SELECT subject to the same privileges, policies, and auditing as any other column.

   2. B. The similarity query and the status update both execute as ordinary SQL under the invoking user's session, so existing privileges and row-level policies filter what the agent can retrieve and change, and the operations remain auditable.Correct answer

      Correct: AI Vector Search is expressed as SQL over vector columns in existing tables, so the agent's retrieval and its action inherit the database's authorization, row-level security, and audit machinery rather than bypassing them.

   3. C. Grounding the agent on governed database data means the retrieval step is already trusted, so row-level policies can be bypassed for the agent's session to guarantee complete answers.

      Confuses 'the data is governed' with 'the agent may ignore data-access policies'. Grounding does not grant entitlement; disabling row-level filtering for the agent would let a user see rows they are not authorized to read.

   4. D. Running the agentic workflow inside the database removes the need to grant or manage privileges, because the database implicitly authorizes any AI-driven operation it hosts.

      Represents the misconception that in-database AI eliminates access control. Co-location strengthens enforcement precisely because privileges still apply — it does not create an implicit grant for AI-issued statements.

   Explanation

   AI Vector Search stores embeddings in a native VECTOR column inside ordinary tables and exposes similarity search through SQL, so an agent's retrieval is just a query and its action is just DML or a procedure call. Both therefore run in a database session under a real user identity and inherit that identity's privileges, row-level security, and unified auditing. The idea that vectors escape access control because they are numeric ignores that they are a column like any other; the idea that grounded data can be read policy-free confuses data provenance with user entitlement; and the idea that hosting AI in the database implies authorization inverts the actual benefit, which is that existing grants keep applying without a separate copy of the data.

2. Question 2

   An agent answers questions about supplier contracts held in an Oracle AI Database 23ai table. Each row holds the contract text chunk, its embedding in a `VECTOR` column, and ordinary relational columns such as `region` and `status`. A user in the EMEA organization asks a broad question, and the agent's retrieval tool must return only chunks from active EMEA contracts while still ranking them by semantic relevance to the question. Which capability of **AI Vector Search in the Oracle AI Database** best supports this retrieval requirement?

   1. A. Vector similarity queries cannot be constrained by relational predicates, so the agent must fetch the nearest neighbors first and then discard non-EMEA rows in application code.

      Assumes vector search is a bolt-on that ignores SQL predicates. Because the vectors live in a table column, the same statement can apply `WHERE` filters, so filtering does not have to be pushed into the agent's code after the fact.

   2. B. The agent should describe the EMEA and active-status restrictions in natural language inside the prompt, because the vector search itself reasons about which retrieved rows the user is entitled to see.

      Attributes reasoning to the retrieval mechanism. Vector search only computes and ranks distances; it makes no judgments about entitlement, and relying on prompt wording to enforce a data restriction leaves out-of-scope rows in the retrieved context.

   3. C. Storing embeddings for a table means its relational columns are superseded by the vector representation, so `region` and `status` must be re-encoded into the embedding text to be usable as filters.

      Believes vectors replace the relational model. The `VECTOR` type is an addition to the table, not a substitute for its columns; the structured columns remain fully queryable and are the reliable way to express an exact filter.

   4. D. Because the embeddings sit in a column of an ordinary table, one SQL statement can combine relational `WHERE` predicates with a vector-distance ordering, so filtering and semantic ranking happen together in the database.Correct answer

      Correct. AI Vector Search adds vectors as a native data type inside the converged database, so similarity search can be expressed in SQL alongside relational, and other search over the same tables — the query can filter on `region` and `status` and still rank by vector distance.

   Explanation

   AI Vector Search introduces a native `VECTOR` data type and similarity search into the converged Oracle Database, so embeddings live in the same tables as business data and a single SQL statement can mix relational predicates with similarity ordering. That lets the agent's retrieval tool enforce exact filters such as region and status while ranking the surviving rows by semantic closeness, without a second post-processing pass. Post-filtering in application code is unnecessary and can leave too few relevant rows; the search engine ranks by distance and does not reason about entitlement, so restrictions stated only in the prompt are not enforced; and adding a vector column does not retire a table's relational columns, which remain the dependable filtering mechanism.

3. Question 3

   A compliance agent grounds its answers by running a vector similarity query over a table of internal policy documents in an Oracle AI Database. Each row stores the policy text plus a `VECTOR` column holding an embedding of that text, and the embedding column has a vector index. The policy team then rewrites several policies, updating the text columns in place, but no step in the pipeline recomputes the embeddings. Weeks later the agent is still quoting the superseded wording, even though the current text is sitting in the same rows it retrieved. Which statement best explains this behaviour?

   1. A. Vector similarity search reads only the most recently inserted rows, so updates made to existing rows are invisible to the agent's retrieval tool until those rows are deleted and re-inserted.

      Invents a recency restriction that does not exist. Similarity search ranks all indexed vectors by distance regardless of when a row was written; the problem is that the stored vectors no longer describe the current text, not that updated rows are skipped.

   2. B. The vector index automatically re-derives each row's embedding from the current text whenever the row changes, so the stale quotations must instead come from the agent caching earlier tool results.

      Confuses maintaining an index over stored vectors with regenerating those vectors. An index organizes the vector values it is built on for fast nearest-neighbour lookup; it does not call an embedding model to recompute a vector from changed source text.

   3. C. The stored vectors are derived data that still encode the old wording; because retrieval ranks rows by distance to those vectors, the agent's grounding context reflects the policies as they were when embedded until the embeddings are regenerated.Correct answer

      Correct. An embedding is a vector representation produced from content at a point in time; if the content changes and the embedding is not recomputed, similarity search matches on the stale representation, so the agent retrieves and grounds on out-of-date material.

   4. D. Similarity search compares the query text against the document text directly, so the mismatch means the rewritten policies now share too few keywords with the agent's questions to be matched.

      Describes keyword matching rather than vector search. The similarity query compares the query embedding with stored embeddings in vector space, not question text against document text, so keyword overlap is not the mechanism at work.

   Explanation

   In AI Vector Search the embedding stored in a `VECTOR` column is derived data — a numeric representation generated from the content by an embedding model — and a similarity query ranks rows by the distance between the query vector and those stored vectors. Editing the source text does not change the vector that was computed from the earlier version, so the agent's retrieval step keeps matching against the superseded meaning and feeds stale passages into its prompt; keeping the embeddings in step with the content is a required part of the grounding pipeline. Retrieval does not restrict itself to recently inserted rows, a vector index accelerates nearest-neighbour lookup over the vectors it indexes rather than regenerating them from text, and the comparison happens between embeddings rather than between raw query text and document keywords. The concept under test is that the freshness of an agent's grounding context depends on the freshness of the embeddings, not merely on the freshness of the underlying rows.

4. Question 4

   A regulated insurer is building an in-database agentic workflow on Oracle Database 23ai. Auditors require that, for every answer the agent gives about policy terms, the team be able to show exactly which policy documents and which rows the answer was derived from, and be able to revoke a claims adjuster's access to certain policies and have the agent immediately stop using them. Which approach best satisfies these audit and access-control requirements, and why?

   1. A. Ground the agent with AI Vector Search over the policy data, because the similarity search returns the actual rows and documents used as context and runs as a database query subject to the user's existing privilegesCorrect answer

      Correct. Because AI Vector Search executes as SQL against vectors stored with the business data, the retrieved rows are concrete and citable, and the query is governed by the database's existing security, access control, and auditing — so revoking access removes those rows from what the agent can retrieve on the very next query.

   2. B. Fine-tune the model on the full policy corpus, because knowledge encoded in weights can be traced back to the individual training documents that produced each answer

      This assumes fine-tuning preserves per-document provenance. Training distributes patterns across parameters, so a generated answer cannot be attributed to specific source documents, and there is no mechanism to un-learn a document when access is revoked.

   3. C. Fine-tune the model but retain the training data export, because keeping the export file alongside the model provides the same row-level access enforcement the database offers

      This confuses keeping a copy of training data with enforcing access on it. A retained export is not consulted at inference time and enforces nothing; the fine-tuned model still answers from weights regardless of what privileges the calling user holds.

   4. D. Either approach works equally well, since grounding and fine-tuning are interchangeable ways of giving a model access to private enterprise facts

      This is the interchangeability misconception. The two techniques differ fundamentally in where the knowledge lives — queryable data versus fixed parameters — which is precisely what determines whether provenance and revocation are possible.

   Explanation

   Oracle AI Vector Search keeps embeddings in the database next to the business data they describe, so a similarity search is an ordinary database query that returns identifiable rows and documents and inherits the database's existing security, access control, and auditing. That makes the retrieved context citable for auditors and makes a privilege revocation take effect on the next query, with no model change required. Fine-tuning instead distributes knowledge across parameters, which destroys per-document attribution and offers no way to withdraw a document once trained, whether or not a training export is kept on hand. Because the two techniques place knowledge in fundamentally different places, they are not interchangeable for requirements built on provenance and revocation.

5. Question 5

   An asset manager is reviewing an in-database agentic workflow on Oracle Database 23ai. The agent grounds its answers with **AI Vector Search** similarity queries over embeddings stored on the `RESEARCH_NOTES` table and can call a PL/SQL procedure that flags a note for compliance review. The governance board asks the architect to justify, in concept terms, why running the workflow inside the database helps them meet their control obligations rather than merely being a performance choice. Which TWO statements correctly express that governance rationale?

   1. A. Because the vectors are stored with the business data they describe, the same database security, backup, and recovery mechanisms that already protect those rows also cover the retrieval data — no separate control regime is needed for the embeddings.Correct answer

      Correct. Oracle documents that keeping vectors alongside the operational data lets existing database security and availability features apply to them, which is precisely a governance argument, not just a performance one.

   2. B. Because the similarity search is an ordinary SQL operation on a database session, it is subject to that session's privileges and policies and appears in the database's auditing like any other statement.Correct answer

      Correct. AI Vector Search is exposed through SQL over a VECTOR data type, so retrieval inherits the standard authorization and audit machinery rather than needing a parallel enforcement layer.

   3. C. Because the agent runs inside the database, it operates with the database's own trusted identity and is therefore exempt from the row-level policies that apply to human users.

      The 'in-database means privileged' misconception. Locality of execution grants no exemption; the workflow is still authorized as whatever account its session uses, and least privilege applies to it exactly as to a person.

   4. D. Because retrieval and generation happen in one product, the workflow can send retrieved note text to any external model endpoint without affecting the firm's data-residency position.

      Confuses where retrieval runs with where data ultimately travels. Placing governed content into a prompt sent outside the jurisdiction moves that content, regardless of how the retrieval step was executed.

   5. E. Because the retrieved context is grounded in already-approved internal records, the compliance-flagging action it triggers needs no authorization check of its own.

      Conflates read-side grounding with write-side authorization. Trustworthy inputs say nothing about whether the caller is entitled to perform the state-changing action, which requires its own privilege check.

   Explanation

   The governance case for running an agentic workflow where the data lives rests on inheritance of existing controls: Oracle AI Vector Search keeps vectors in the database next to the data they describe, so the security, backup, and recovery mechanisms already protecting those rows extend to the retrieval data, and because similarity search is issued as SQL on a normal session, it is authorized and audited by the same machinery as any other statement. Locality is not a privilege grant — an in-database agent is still bound by the privileges and row-level policies of the account it connects as. Nor does in-database retrieval license sending retrieved content to an external endpoint, since residency follows the data wherever a prompt carries it, and grounding on approved records never substitutes for authorizing a state-changing action.

6. Question 6

   A telecom operator runs an agentic assistant inside Oracle Database 23ai. The agent grounds its answers by running **AI Vector Search** similarity queries over embeddings stored on the `SUPPORT_CASES` table, and it can also call a PL/SQL procedure that issues an account credit. Each end user connects on their own database session. During a design review, an engineer argues that because the retrieval step already runs under the caller's account and is constrained by that account's privileges and row-level policies, the credit-issuing step needs no authorization of its own — the read-side controls have, in effect, "already cleared" the agent to act. Which statement best evaluates that argument?

   1. A. The argument is wrong: the action must be authorized independently — the procedure executes on the same governed session, so the agent should hold `EXECUTE` on a narrowly scoped procedure rather than broad DML, and the resulting change is captured by the database's audit trail.Correct answer

      Correct. Retrieval and action are separate operations under the database's existing access controls; keeping the agent's tool calls inside the database means each one is authorized by its own privileges and recorded by normal database auditing.

   2. B. The argument is sound: privileges that permit a session to retrieve a row also permit the agent to modify that row, so read-side controls settle the action step as well.

      Confuses read authorization with write authorization. `SELECT` on a table (and passing a row-level read policy) confers no `UPDATE`, `INSERT`, or `EXECUTE` right; the action step is authorized by its own separate grants.

   3. C. The argument is sound: running the workflow inside the database means the database governs it end to end, which removes the need to grant or restrict privileges for the agent's actions individually.

      The misconception that in-database AI removes the need for access control. Running where the data lives means the existing controls apply to the workflow — it does not mean privileges stop having to be granted deliberately and narrowly.

   4. D. The argument is wrong because database auditing cannot record actions taken on an agent's behalf, so the only usable record of the credit is a log kept by the external agent framework.

      Assumes auditability must come from outside the database. The agent's action is an ordinary PL/SQL call on a database session, so the database's own audit facilities record it like any other database operation.

   Explanation

   Keeping an agentic workflow inside Oracle Database 23ai means retrieval and action are both ordinary database operations subject to the existing access-control model — but they are different operations with different privileges. Being permitted to read a row through a similarity query says nothing about being permitted to change it, so the action step needs its own grant, ideally `EXECUTE` on a narrowly scoped procedure rather than broad DML, and it is recorded by the database's audit trail like any other statement. The view that read clearance extends to writes ignores that distinction, and the view that in-database execution removes the need to grant privileges misreads what "governed by the database" means. Claiming the database cannot audit agent actions is also incorrect: the tool call is a normal PL/SQL call on a governed session, which is exactly why running the workflow where the data lives helps enforce governance.

7. Question 7

   An insurance company runs an agentic workflow whose tools are database operations: an AI Vector Search retrieval step over embeddings stored in the `CLAIMS_DOCS` table, and an action step that updates claim status rows. Auditors require an end-to-end record of what the agent read and what it changed, with each event attributable to an identity. The team argues about how to satisfy this and whether a new audit mechanism must be built for the agent. Which approach best meets the **auditability** requirement for this in-database agentic workflow?

   1. A. Rely on the application's own log file of agent prompts and responses, because the database cannot observe queries issued by an AI workflow.

      Assumes AI-issued SQL is somehow invisible to the database. Vector search and DML executed by the agent are ordinary SQL statements against database objects, so the database's own auditing observes them like any other workload; an application-side prompt log is unattributable to database identities and can be bypassed.

   2. B. Have the agent connect through a single shared privileged database account and record the agent's reasoning trace, since a shared account simplifies the audit trail.

      A shared, over-privileged account destroys attribution — the exact property auditors want — and a reasoning trace is not evidence of what data was actually read or written. It also breaks least privilege by giving the agent access beyond any individual end user.

   3. C. Because the retrieval and the action both execute as SQL inside the database under a database identity, the database's existing auditing captures them, and the agent's operations should be scoped to that identity's privileges.Correct answer

      Correct: vector similarity search is executed by SQL against vector columns in the database, so the agent's retrieval and DML are normal auditable database operations under the connected identity, and existing audit and privilege mechanisms apply without a bespoke mechanism.

   4. D. Export the embeddings and claim rows to an external vector store where the agent runs, then reconcile that store's logs with the database periodically.

      Moving the data out is what creates the audit gap: the copy leaves the governed store, so reads against it never appear in database auditing, and periodic reconciliation cannot reconstruct who read what and when.

   Explanation

   AI Vector Search stores embeddings in a native `VECTOR` data type inside the database and performs similarity search through SQL, so an agent's retrieval step is an ordinary database operation executed under the connecting database identity — the same auditing and privilege machinery that covers the rest of the workload covers it, with no separate audit path to build. Treating AI-issued queries as invisible to the database misreads how in-database vector search executes; funnelling the agent through one shared privileged account removes the attribution auditing depends on and violates least privilege; and copying the data to an external store is precisely what puts reads outside the database's audit trail.

8. Question 8

   An insurer is designing an in-database agentic assistant on Oracle Database 23ai. The retrieval step runs **AI Vector Search** similarity queries over a `VECTOR` column on the `CLAIMS` table, which is protected by object privileges and a row-level policy that limits each adjuster to the claims in their own region. To simplify the build, an architect proposes that the agent always connect through one shared, highly privileged schema account and rely on the similarity ranking to return "only what is relevant" to whoever asked. Which statement best evaluates this design from a governance standpoint?

   1. A. The design is sound, because a similarity search returns only semantically relevant rows, so relevance ranking effectively acts as an authorization filter for each requester.

      Confuses relevance with authorization. Vector distance ranks rows by semantic closeness to the query; it carries no notion of who is asking and will happily return the nearest out-of-region claim.

   2. B. The design is unsound: the agent should execute retrieval under the requesting user's identity (or a suitably least-privileged account), so the existing privileges and row-level policy constrain what the vector query can return.Correct answer

      Keyed answer. Vector data is stored and queried like any other database data, so the SQL that runs the similarity search is evaluated against the connected user's privileges and row-level policies — which only protect the workflow if the agent connects as a principal those controls actually restrict.

   3. C. The design is sound, because moving AI processing inside the database removes the need for per-user access control — data that never leaves the database is governed by definition.

      The misconception that in-database AI makes access control unnecessary. Running where the data lives lets existing privileges and policies apply; it does not replace them, and a shared privileged account deliberately sidesteps them.

   4. D. The design is sound as long as the database is reachable only over a private network endpoint, since governance of an agentic workflow is fundamentally a network-perimeter concern.

      Reduces governance to network isolation. A private endpoint controls who can reach the database, not what an authenticated over-privileged session may read once connected; row-level entitlements are enforced inside the database, not at the perimeter.

   Explanation

   Because AI Vector Search stores vectors in a native column and retrieves them with ordinary SQL, a similarity query is subject to exactly the same object privileges and row-level policies as any other query issued by that session — which is precisely why the agent must connect as a principal those controls bind, rather than as a shared superuser. Relevance ranking orders results by vector distance and encodes nothing about the requester's entitlements, so it cannot substitute for authorization. Keeping the workflow in the database enables existing access control to apply but never removes the need for it, and a private network endpoint governs reachability only, leaving an authenticated over-privileged session free to read everything.