Oracle Analytics and AI

Susana Lopes-Oracle

Summary
Enable authors of AI Agents to assign a data classification label at design time, which is automatically embedded and preserved in all agent-generated and exportable content.

Problem Statement
Current AI Agent outputs lack a mechanism to tag data sensitivity or classification. This creates risk when content is exported or shared outside OAC, as consumers have no visibility into handling requirements (e.g., Confidential, Internal, Public).

Proposed Requirement
Introduce a configurable property within the AI Agent configuration that allows the author to assign a data classification label. This label must persist across all generated outputs and be included in exported artifacts.

Key Functional Requirements

• Add a “Data Classification Label” field in the AI Agent authoring interface.
• Allow author to predefine values, for example:
  • Public
  • Internal
  • Confidential
  • Restricted
  • Confidential - Company Name Internal
  • Confidential - Company Name Restricted
  • Confidential - Company Name Highly Restricted
• Automatically attach the selected label to:
  • Agent-generated responses (UI display)
  • Downloaded/exported outputs (PDF, CSV, Excel, etc.)
• Data classification label is optional

User738992-Oracle

This is a well-conceived and strategically important enhancement that warrants strong support. Implementing a Data Classification Label within the AI Agent authoring framework would represent a meaningful and necessary advancement in Privacy, Security, and Governance (PS&G) maturity for the platform.

As AI Agents become increasingly embedded in enterprise workflows, the outputs they generate — whether surfaced in the UI or exported as PDFs, CSVs, or Excel files — carry an inherent responsibility for appropriate handling. Without a mechanism to signal data sensitivity, consumers of that content are left without critical context, creating real risk of inadvertent misuse, oversharing, or non-compliance with internal data governance policies and applicable regulatory requirements.

The proposed feature directly addresses this gap. By allowing agent authors to assign a classification label at design time — with values such as Public, Internal, Confidential, or Restricted — and ensuring that label automatically persists across all generated outputs and exported artifacts, the platform would establish a consistent, low-friction governance control. Importantly, this approach places accountability at the point of creation, where context and intent are best understood, rather than relying on downstream consumers to make sensitivity determinations on their own.

Several additional considerations worth noting in support of this feature:

• Regulatory and Compliance Alignment: Many organizations operate under frameworks (e.g., GDPR, HIPAA, SOC 2, ISO 27001) that require demonstrable controls around data classification and handling. Embedding classification labels into agent outputs would support audit readiness and policy enforcement.
• User Awareness and Behavioral Guidance: Visible classification labels serve not only as metadata but as behavioral prompts — reminding recipients of their obligations before they share, forward, or store content.
• Extensibility: The predefined label taxonomy (including organization-specific labels such as "Confidential – [Company Name] Highly Restricted") is a thoughtful design choice that balances standardization with the flexibility enterprises require to align with their existing data classification policies.
• Optional by Design: Keeping the field optional ensures adoption is not blocked by use cases where classification is not applicable, while still making the capability available where it matters most.

Overall, this feature would be a valuable and practical addition to the platform's governance capabilities. It is strongly recommended for prioritization, and consideration should be given to future extensibility — such as integration with downstream DLP (Data Loss Prevention) tools or document management systems that can act on classification metadata programmatically.