We’re investigating an authorization issue in Oracle Fusion AI Agent Studio 26C in our non-production environment. Our developers can create and update their own custom business objects, but cannot save changes to business objects created by another developer.
We reproduced this with two users and two simple, manually created test business objects:
Test | Result |
|---|
User 1 creates BO1, reopens it, and updates its description | Successful |
User 2 updates BO1’s description | Authorization denied |
User 2 creates BO2, reopens it, and updates its description | Successful |
User 1 updates BO2’s description | Authorization denied |
The objects are configured under SCM → Inventory Management, using Monolith resource.
The error is:
Authorization is denied for action update on business object oraCommonFusionAIAgents.SupportedObject identified by key $primary{supportedObjectId=…}.
Browser network capture shows an HTTP 403 on the PATCH request to the AI Agent Studio supportedObjects endpoint. This happens when saving the BO definition after changing only its description; no inventory REST function is being executed.
The results suggest that creator/owner-related access may be involved, but we have not confirmed the underlying policy. This is blocking shared maintenance of our agent’s business objects.
We have an open SR. The automated recommendations received so far have not resolved the issue or identified the specific authorization requirement.
Specifically, we have followed this guidance provided in the SR already:
For the AI Agent Administrator role after the 26C upgrade, you need to create a custom role with the following duty roles assigned:
Manage All Intelligent Agents (ORA_FAI_MANAGE_ALL_AI_AGENTS)
Fai Genai Agent CX Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_CX_ADMINISTRATOR_DUTY)
Fai Genai Agent FIN Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_FIN_ADMINISTRATOR_DUTY)
Fai Genai Agent GRC Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_GRC_ADMINISTRATOR_DUTY)
Fai Genai Agent HCM Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_HCM_ADMINISTRATOR_DUTY)
Fai Genai Agent PRC Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_PRC_ADMINISTRATOR_DUTY)
Fai Genai Agent PRJ Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_PRJ_ADMINISTRATOR_DUTY)
Fai Genai Agent PSC Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_PSC_ADMINISTRATOR_DUTY)
Fai Genai Agent SCM Administrator Duty (ORA_DR_FAI_GENERATIVE_AI_AGENT_SCM_ADMINISTRATOR_DUTY)
Has anyone encountered this behavior, or can someone from the Oracle AI Agent Studio team clarify:
- Is restricting updates to the BO’s creator expected behavior in 26C?
- Which role, privilege, or data security policy enables authorized developers to update BOs created by other users?
- Are there additional AI Agent Administrator security requirements introduced in 26C, and where are they documented?
We can provide the detailed reproduction steps and diagnostic evidence through the SR. Any guidance or connection to the appropriate product team would be appreciated.
