Don't Let AI Agents Write Raw SQL: A Safer Pattern from Oracle

The core argument. Jeff Smith from Oracle argues that the biggest risk with AI agents interacting with enterprise databases is not technical capability but data safety. He positions Oracle's AI database as a platform that natively supports vectors, graphs, and relational data within a single SQL interface, eliminating the need to replicate data across multiple stores for RAG pipelines.

The dangerous default. Smith warns that natural language to SQL, while exciting, is fundamentally unreliable and risky for production use. He points out that LLMs frequently generate queries that return plausible-looking but incorrect results, and that teams often lack the governance to catch these errors before they affect decisions. The financial and reputational cost of a wrong query or leaked PII is too high for most organizations.

A safer alternative. Instead of letting agents generate arbitrary SQL, Smith advocates for a report-based approach: pre-authorize parameterized reports that are hard-coded by experts. The agent selects the right report from a catalog, not the SQL to execute. Oracle's MCP server supports this with two tools: list reports and execute reports, keeping the LLM from generating queries directly.

Security at the database layer. Smith emphasizes that security must live in the database, not just in the tooling. Oracle pipes user identity through single sign-on (Azure AD) and applies row-level security dynamically based on roles. This means a query returns only the data the user is allowed to see, even if the agent generates the same SQL for two different people. This is the most important safeguard for production deployments.

Realistic use cases. Beyond reporting, Smith shows how agents can assist with performance tuning: diagnosing slow queries on a read-only standby instance, collecting optimizer statistics, and generating reports, but never making changes directly. He also describes schema annotation tools that document cryptic table names for both humans and agents, reducing the time spent reverse-engineering the data model.

The hype filter. This is largely a vendor pitch, albeit a pragmatic one. The report-based approach is a sensible governance mechanism, but the claim that Oracle's database is uniquely capable is unsubstantiated by benchmarks or independent evidence. The talk is most useful for the security architecture and the pattern of constrained agent actions, not the Oracle-specific features.