#1171 - Private Agent Framework - OIC Authorization

Introduction

There are multiple authorization options available when connecting to OIC based MCP Servers from PAF. Let's check them out - 

Bearer Token

This is good for quick demos etc. You can use an existing confidential app, which is configured for OIC. The downside here is that the token is not refreshed, so you end up going back and forth to Postman to generate tokens, then copying and pasting them into PAF.

OAuth Configuration

Here you need to create a Confidential App for PAF - 

Copy client id and secret. Then let's look at the OAuth configuration - 

The redirect URL needs to point to PAF - 

The URL format is as follows - 

Take your base PAF URL then add /agentFactory/v1/tools/mcp/callback

Add the usual OIC resources - 

The final step is to activate the app; then you're good to go.

I now go back to PAF and create the OAuth based connection to my OIC MCP server -

As you can see, the refresh URL is available here. 

I add the client id and secret - 

The IDCS URL used for the following - 

is the one you already use for your OIC instance. I copy it from postman - 

https://myIDCS/oauth2/v1/token

use this for Token and Refresh URLs.

Set Authorization URL to 

https://myIDCS/oauth2/v1/authorize
 

Set Scopes to the usual OIC scopes. These I copy from postman.

Click Test - then you will see the following message -

Click Save MCP server - 

Summa Summarum

Like most things, the process is simple enough; you just need to know what to do.

Come to think of it, that's quite philosophical!

 
 

 

#1170 - Private Agent Framework - SELECT AI Deep Dive

Introduction

My previous PAF posts have covered the basics, now for a few more details. This post covers setting up PAF for SELECT AI and then using the SELECT AI components in a workflow.

Firstly, what does Select AI offer us in PAF? Here is a list of the components -

Pre-requisites for SELECT AI

There are a few pre-requisites we need to fulfill, in order to fully leverage these, namely, the creation of profiles, credentials and vector indexes. Let go through these, explaining what each is and how to create them. 

Credentials

In PAF Select AI, a credential is the stored authentication object that lets your selected database call an external provider. This could be an AI provider, such as OpenAI. Net, net, I'm letting the DB invoke a 3rd party, using these credentials.

You can create this credential through the PAF UI, or via the following - 

BEGIN

  DBMS_VECTOR.CREATE_CREDENTIAL(

    credential_name => 'OPENAI_CRED',

    params          => JSON('{

      "access_token": "youeAccessToken"

    }')

  );

END;

/

The UI list is exhaustive and includes many LLMs as well as OCI, Email, Slack etc.

Once you have the credential, then create a profile.  

Profiles

A profile in PAF Select AI is a reusable configuration that tells a database how to use an AI provider for a particular task. Think about it, the credential for OpenAI we just created allows us to invoke OpenAI, here we specify the details - e.g. 

• AI provider and model — e.g. OpenAI + gpt-4.1
• Credential to use — e.g. OPENAI
• Capability — NL2SQL, RAG, or both
• Optional embedding model — for RAG, e.g. text-embedding-3-large
• Scope/settings — such as the database objects or vector indexes available to the AI workflow

I'm not using the Embedding model, but, for those interested, this enables your agent to answer questions from your own documents—policies, manuals, product descriptions, tickets—rather than relying on the LLM's general knowledge. Naturally, this greatly improves the relevance of the answers and ensures they cite current internal content. I cover the setup of the Embedding model and it's pre-requisites in a dedicated section below.

EnableNL2SQL

Natural-language question → AI generates SQL → OrdersDB runs SQL → result

Here I can specify which schema, tables, views etc. to use.

Also note the ability to restrict queries to these database objects.

Enable RAG - what is it?

Enable RAG turns on Retrieval-Augmented Generation. It lets the AI answer using content you have indexed—such as PDFs, manuals, policies, or product documentation; naturally ensuring far superior results, compared to relying on the selected model’s general knowledge.

And yes, to use RAG, you need to specify an embedding model, e.g. text-embedding-3-large.

You also need a vector index - 

A vector index is the searchable store RAG uses to find the most relevant pieces of your documents.

When you create it, PAF will do the following -

• Read your source documents.
• Split them into smaller chunks.
• Use the embedding model to turn each chunk into a vector—a numeric representation of its meaning.
• Store and index those vectors in the database.

How does this work at runtime? 

Question → embedding vector → vector index finds similar chunks

→ RAG sends those chunks to the LLM → grounded answer

An example of leveraging such could be - 

• Chat input - "How do I get a refund?"
• The index retrieves a policy section titled "Returns and reimbursements" 
• The model answers, based on that content

Set this all up as follows - 

Enabling RAG / Vector Indexes

Upload docs to Object Storage

Make your corporate docs available in an OCI Object Storage Bucket -

Create a new OCI Credential in PAF

This is to allow access to this bucket -

Enter user ocid etc. 

You can validate by executing the following SQL e.g. - 

SELECT object_name, bytes

FROM DBMS_CLOUD.LIST_OBJECTS(

  credential_name => 'OCI_OBJECT_STORAGE_CRED',

  location_uri    => 'https://objectstorage.us-phoenix-1.oraclecloud.com/n/NNNNNNNNN/b/niallc-orderProcessingDocs/o/'

);

Create a PAF Profile for RAG

This should specify the following values -

Now use this profile when creating the Vector Index.

Create Vector Index

Use the above values.

Validate and create - 

Please excuse the mismatch in the vector index names, between the screenshots.

You can also create the Vector index, using the following SQL - 

BEGIN

  DBMS_CLOUD_AI.CREATE_VECTOR_INDEX(

    index_name           => 'ORDER_PROCESSING_DOCS_RAG_INDEX',

    wait_for_completion  => FALSE,

    attributes           => '{

      "vector_db_provider": "oracle",

      "location": "https://objectstorage.us-phoenix-1.oraclecloud.com/n/nnn/b/niallc-orderProcessingDocs/o/",

      "object_storage_credential_name": "OCI_OBJECT_STORAGE_CRED",

      "profile_name": "OPENAI_EMBED_PROFILE",

      "vector_dimension": 3072,

      "vector_distance_metric": "cosine",

      "chunk_size": 1024,

      "chunk_overlap": 128,

      "match_limit": 5,

      "similarity_threshold": 0.6,

      "refresh_rate": 60

    }'

  );

END;

/ 

Setup is complete, so let's use the Select AI components...

Using the Select AI Components

Select AI

Try in Playground - 

In-Database Agent / Tasks

An In-Database Agent is a reusable, database-hosted AI agent definition. It runs in Oracle Database and uses a Select AI profile for its model, credentials, and data access.

Create new - 

In-Database Tasks define what the agent can do - 

Connect - 

To run this we need an In-Database Team - 

An In-Database Team is an in-database orchestrator for one or more In-Database Agents.

It is the node that receives a user prompt and decides which attached agent(s) should handle it.

I also need an In-Database Tool - 

Tool type is set to SQL and the description I use is - 

Run read-only SQL queries against the approved OrdersDB tables to answer order and customer questions.

I run in Playground - 

Creating a Simple RAG Workflow

Step 1 is the ensure we have the relevant profile - 

Mine is called OPENAI_RAG_PROFILE.

The profile can be created via the UI or via the following SQL - 

BEGIN DBMS_CLOUD_AI.CREATE_PROFILE( profile_name => 'OPENAI_RAG_PROFILE', attributes => '{ "provider": "openai", "credential_name": "OPENAI", "model": "gpt-4.1", "embedding_model": "text-embedding-3-large", "vector_index_name": "ORDER_PROCESSING_DOCS_RAG_INDEX", "temperature": 0.2, "max_tokens": 1024 }' ); END;

/

In the Workflow, drop the SELECT AI component - 

FYI - here are my order guidelines - 

So let's test the new workflow in Playground - 

I ask - Can customers from Ireland order iBikes?

The response - 

No, customers from Ireland cannot order iBikes. The order guidelines specifically state that there are no iBike sales to customers from Ireland.

Sources:

• Order Guidelines for NiallC Corp.txt (https://objectstorage.us-phoenix-1.oraclecloud.com/n/nnn/b/niallc-orderProcessingDocs/o/Order Guidelines for NiallC Corp.txt)

Summa Summarum

PAF is pretty powerful - rich in functionality, powered by the Oracle AI Database. Try it out, especially with OIC based MCP tools to interact with enterpise apps etc. 

Cerevisia Aestiva

Today's beer is from Weissenofer Klosterbrauerei - an excellent companion to my Franconian "Sauerbraten". 

This is an abbey brewery, located in the Fränkischen Schweiz, a place of natural beauty just north east of Nuremberg.

The abbey was founded in 1109, and I assumed that got brewing soon after that. 

High attenuation and precise mashing meet classic Hersbrucker hops to strike the perfect balance between rich malt vibes and a smooth, crisp bitterness. Super refreshing and lively, it's brewed with pure spring water, local Franconian malt, and premium hops straight from the "Hersbrucker Gebirge" hills.

So what's with the high attenuation and precise mashing?

Attenuation refers to the percentage of sugars in the wort that the yeast successfully converts into alcohol and carbon dioxide during fermentation. What's the value-add of this? - net, net, the yeast ate almost all the sugar. This leaves very little residual sweetness behind, resulting in a dry, clean, and crisp finish rather than a heavy or sugary mouthfeel. Ant pray tellme, who doesn't want that?

Mashing is the hot-water soaking process at the very beginning of brewing that activates natural enzymes in the malt, turning starches into fermentable sugars. 

Precise mashing means the Weissenhofer folks carefully controlled the temperature rests to get the exact sugar profile they wanted. This ensures the beer has a solid malt backbone and body to support the hop flavors, keeping it perfectly balanced instead of watery.

A beer with a smooth, crisp bitterness, powered by a solid malt backbone; and, at the restaurant price of 4 euros, a real steal.