API Security and Authorization Controls

Summary:

We understand that AI agents may invoke Fusion REST APIs or other enterprise tools to perform actions (e.g., retrieving data or executing workflows).

From a security architecture perspective, we want to confirm how Oracle handles authorization in these scenarios. Specifically:

• Do AI agents always execute actions under the end-user’s identity and existing Fusion role-based access controls, or can they execute actions using a service identity?
• Are there recommended patterns to ensure user-level authorization is enforced when agents invoke APIs or workflows?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):