--- 格式版本: 2 标题: "Oracle Deep Data Security Extends Authorization Across Remote Databases, Lakehouse Data, and Related Tables | database" 原文链接: "https://blogs.oracle.com/database/oracle-deep-sec-extends-authorizations" 发布日期: "2026-08-13" 发布时间校准状态: "found" 发布时间需复核: "否" 发布时间来源: "rule:local:strict_original_body" 发布时间证据: "August 13, 2026 5 minute read" 发布时间校准原因: "规则确认唯一严格发布时间，来源 local:strict_original_body" 发布时间校准置信度: "high" 发布时间候选数量: 6 发布时间严格候选数量: 1 发布时间原页读取状态: "source template page reused from URL open" 发布时间未找到原因: "" 发布时间校准时间: "2026-08-14T19:26:39+08:00" 发布时间仲裁状态: "skipped" 发布时间仲裁尝试次数: 0 发布时间仲裁耗时毫秒: 0 发现时间: "2026-08-14T19:19:31+08:00" 入库时间: "2026-08-14T11:26:39.907Z" 来源平台: "固定入口" 搜索渠道: "fixed_url" 搜索词: "https://blogs.oracle.com/?page=news" 匹配关键词: - "AI" 相关厂家: - "Oracle" - "Microsoft" 相关专家: [] 内容类型: "网页" 抓取工具: "CDP Render" 清洗工具: "CDP Text + Defuddle/Readability 正文提取" 原始附件: [] AI优质: "否" AI打分: 0 AI分档: "非优质" AI质检状态: "不通过" AI打分理由: "内容为Oracle数据库安全功能介绍，与超节点/AI Rack/机柜级AI基础设施无关。" AI质检模型: "tx-deepseek-v4-flash" AI质检时间: "2026-08-14T19:27:01+08:00" AI主题相关性: 0 AI来源权威性: 0 AI新颖性: 0 AI技术细节: 0 AI商业部署信号: 0 AI完整性: 0 AI摘要: "Oracle Deep Data Security在DBRU 23.26.3中把端用户授权扩展到远程数据库、对象存储和数据湖仓，并新增跨表数据授权及高级SQL分析的安全控制。" AI摘要模型: "ali-deepseek-v4-flash" AI摘要时间: "2026-09-07T03:31:29.247Z" 采集批次: "2026年8月14日18点30分41秒" 采集批次ID: "20260814-183041-680" 去重键: "https://blogs.oracle.com/database/oracle-deep-sec-extends-authorizations" --- We previously announced the availability of [Oracle Deep Data Security in Oracle AI Database 26ai](https://blogs.oracle.com/database/oracle-deep-data-security-is-now-available-in-oracle-ai-database-26ai), a new approach to securing data access in the era of AI agents. Deep Data Security enforces the end user’s authorization model directly in the database, even when applications or AI agents query data on the user’s behalf. ***“Oracle AI Database 26ai settles the issue with Deep Data Security, a new feature where the database, not the app tier, is the ultimate arbiter of who can see the data.”*** ***—Tony Baer, Principal, dbInsight*** Modern applications often access enterprise data across remote Oracle and non-Oracle databases, object stores, and data lakehouse platforms. Organizations therefore need end-user authorization to be enforced consistently across these access paths. With Oracle AI Database Release Update 23.26.3 (DBRU 23.26.3), Deep Data Security (Deep Sec) extends end-user authorization to remote databases, object stores, and data lakehouse platforms. It also adds support for cross-table data grants and advanced SQL analytics, extends end-user authorization to the OCI Database Tools MCP service and natural-language queries through Oracle Select AI, expands support to the Node.js database driver, and adds MFA for direct database access. ## Control access to remote data across databases, lakehouses, and object stores Oracle AI Database already provides SQL access to data stored outside the local database, including data in [remote Oracle Databases](https://docs.oracle.com/en/database/oracle/oracle-database/26/admin/distributed-database-concepts.html?utm_source=chatgpt.com#GUID-93B235DD-BF66-444D-9F0F-9D4B2F590C41), [heterogeneous databases, object stores, and lakehouse platforms.](https://docs.oracle.com/en/database/oracle/oracle-database/26/selai/select-ai-live-ai-hub.html?utm_source=chatgpt.com#GUID-7FC8BF72-7F41-4314-87E2-361BAF1AC271) Customers access that data through database links, Oracle Gateway, and supported catalog and object-store integrations. Views that use database links and Oracle Gateway support both queries and DML. Catalog-based access is read-only. With DBRU 23.26.3, Deep Sec extends identity-aware authorization to these access paths. Customers can define data grants on local SQL views that reference remote tables, remote catalogs, and data shares. Remote tables can include Oracle Database 19c tables and supported heterogeneous database tables accessed through Oracle Gateway. When a query runs against one of those views, Oracle AI Database evaluates the data grants using the end-user context. ![Deep Sec enforces authorization locally while the data remains remote](https://blogs.oracle.com/database/wp-content/uploads/sites/78/2026/08/Picture1-1.png) Figure 1: Deep Sec enforces authorization locally while the data remains remote ## Consistent authorization across related tables Enterprise applications typically rely on data from multiple related tables that together form a business object. A customer service workflow may combine account, order, entitlement, and region data across one or multiple schemas. A finance dashboard may join cost centers, transactions, approvals, and organizational hierarchies. With newly added support for cross-table data grants, Deep Sec now allows customers to extend the same authorization policy across related tables. An authorization condition defined against a parent table can be reused for a related child table through a defined join relationship. Each data grant remains associated with a specific table or view, but related grants can reuse the authorization relationship rather than duplicate the grantee list and authorization condition. This allows organizations to model security policies around table relationships while reducing duplicated and potentially inconsistent authorization controls across tables. ![Cross-table data grants support consistent authorization across related tables](https://blogs.oracle.com/database/wp-content/uploads/sites/78/2026/08/Picture2-2.png) Figure 2: Cross-table data grants support consistent authorization across related tables ## Secure analytics workloads that use advanced SQL Oracle Database supports in-database analytical SQL for real-time analysis, interactive decision support, and operational reporting for use cases such as financial reporting, dashboards, and sales analysis. With DBRU 23.26.3, Deep Sec enforces data grants for queries that use analytic functions, including analytic clauses and window-frame specifications. It also enforces data grants for advanced aggregation, including the ANSI-standard GROUPING SETS, CUBE, and ROLLUP. Calculations such as rankings, running totals, moving averages, trend analysis, and rollups are now computed only from the data each user is authorized to access. Developers do not need to reimplement the same authorization rules in their applications or analytics tools. [Learn more about Oracle Analytical SQL and Functions.](https://www.oracle.com/database/technologies/bi-datawarehousing/sql-analytics.html?utm_source=chatgpt.com) ## Ensure Model Context Protocol tools operate within each user’s permissions AI agents increasingly use Model Context Protocol (MCP) tools to query enterprise data systems. To limit each request to data the signed-in user is authorized to access, the database must evaluate access using that user’s identity and context. Deep Sec already enforces data grants when an MCP server forwards the signed-in user’s OAuth 2.0 token to Oracle AI Database along with the MCP server’s own access token. DBRU 23.26.3 extends that model to the **OCI Database Tools MCP service**, where the MCP server exchanges the end-user OAuth 2.0 token with Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) for an OCI Auth token on behalf of that user. Oracle AI Database uses the end-user identity represented by the OCI Auth token to evaluate the applicable data grants for each request. ![Deep Sec authorizes OCI Database Tools MCP requests based on the propagated end-user identity](https://blogs.oracle.com/database/wp-content/uploads/sites/78/2026/08/Picture3-1.png) Caption 3: Deep Sec authorizes OCI Database Tools MCP requests based on the propagated end-user identity ## Enforce end-user authorization for Oracle Select AI Oracle Select AI enables users to query databases in natural language by automatically generating the required SQL. When Select AI executes that SQL, Deep Sec now enforces the data grants applicable to the requesting user, so that the results are limited by the applicable data grants for the requesting user. Even when Select AI generates the same SQL for different users, the results reflect each user’s authorization. ## Support for the Node.js database driver Deep Sec can now be used with Node.js applications that connect to Oracle AI Database, in addition to applications that use the Java, Python, and ODP.NET drivers. The node-oracledb driver, together with its Node.js plugin, lets applications written in JavaScript or TypeScript propagate the end-user security context to Oracle AI Database. The database can then enforce the applicable data grants for that user. For a walkthrough with sample code, see [Oracle AI Database Deep Data Security in Node.js Applications](https://medium.com/oracledevs/oracle-ai-database-deep-data-security-in-node-js-applications-0bf019bcc28c). ## Strengthen direct database access with MFA DBRU 23.26.3 adds multifactor authentication (MFA) support for Deep Data Security end users who connect directly to Oracle AI Database. MFA strengthens authentication for these local end users and makes their MFA status available in the end-user context. Data grants can then use that status as an authorization condition, allowing Oracle AI Database to return data covered by the grant only when the user has successfully completed MFA, where required. ## Key takeaways: Governed data access for the AI era With DBRU 23.26.3, Oracle Deep Sec broadens database-enforced end-user authorization across more data locations, table relationships, and access paths. ***“Blocking data leakage at the source, before it ever reaches the agent, is the right architectural approach.”*** ***—Stephen Catanzano, Senior Analyst, Omdia*** As AI agents and applications create new ways to access enterprise data, Oracle AI Database enforces end-user authorization in the database before data is returned. ## Get started with Oracle Deep Data Security We have expanded Oracle LiveLabs resources to help you get started with Oracle Deep Sec. Lab 1: [Getting Started with Oracle Deep Data Security](https://livelabs.oracle.com/ords/r/dbpm/livelabs/run-workshop?p210_wid=4393) Lab 2: [Identity-Driven Data Access with Microsoft Entra ID and Deep Data Security](https://livelabs.oracle.com/ords/r/dbpm/livelabs/run-workshop?p210_wid=4396) Lab 3: [Cross-Table data grants](https://livelabs.oracle.com/ords/r/dbpm/livelabs/run-workshop?p210_wid=4474)