Search This Blog

Showing posts with label ERP. Show all posts
Showing posts with label ERP. Show all posts

Saturday, October 10, 2026

What Actually Happens When a Fusion Claw Runs

What Actually Happens When a Fusion Claw Runs

The harness, the models, the private container, the memory, and the boundaries that hold it all in.

The word Claw comes with baggage. The open agent harnesses that inspired the name earned a reputation for broad reach: a shell, a file system, a repository, and whatever else you hand them.

So the first thing I wanted to understand about Fusion Claw was not what it can do. It was what it cannot do, and what is actually running underneath it.

Oracle's Fusion AI product management team walked us through it in some detail. Here is the picture as it was described to us.

The runtime

When a Claw runs, Oracle sets up a virtual command line environment and gives the agent harness a controlled set of tools inside it.

·        The primary harness is based on the open source Codex harness.

·        Frontier models from OpenAI provide the planning, analysis, and deep research capability.

·        Skills live inside the virtual file system. Oracle provides some, and authors can add their own to describe how a particular outcome should operate.

Oracle's announcement also names Gemini alongside OpenAI, with support for additional frontier models planned over time. In our session, the discussion centered on OpenAI.

The private container

Each Claw runs in a private virtual container that Oracle hosts in OCI, specifically within its Fusion Spectra service, and that only your company and your users can access.

The lifecycle is sensible:

·        The container is live while the work is running.

·        When the session pauses or completes, Oracle stores the session state and shuts the container down.

·        If you resume, the container is rehydrated from that stored state.

Session information is retained for up to 90 days, and that retention period is something you can set yourself. Keeping it around is what lets you restart a session, continue it after the Claw has finished, or take it down a different path with the same context.

This is also where generated code runs. When a Claw writes code to analyze a large data set, that code executes inside the container, not directly in Fusion.

What it can reach

The Claw's scope is set by the agentic app it belongs to. Authors decide which parts of the app are exposed to the Claw through a capability layer, effectively a subset of the app, along with the skills and guardrails that govern how it pursues the outcome.

Oracle gave two concrete examples of what that means in practice. A Claw will not go set up a REST call outside the domain of its agentic app. And unlike general coding assistants, where you might give the agent access to a Git repository, Fusion Claw does not get that kind of open-ended access. It is limited to the agents and capabilities you make available to that particular outcome.

Whose identity it uses

All data access and all actions happen with the invoking user's token. The Claw only fetches data that user can see, and only takes actions that user has the functional rights to perform.

Combined with the point I made in my previous post, that the Claw plans and orchestrates while the agents execute, this means the Claw itself never holds credentials.

Roles, in layers

One of our architects asked the question every security team will ask: if I can use a Claw, do I inherit access to every agent it can call?

No. Access is layered:

·        A user needs the role for an individual workflow agent to invoke it, or for it to be invoked on their behalf.

·        The agentic app has its own role access, and that is where access to the Claw is set, because the outcome is tied to the app.

·        If a user has access to the app but not to one of its agents, that agent simply does not participate on that user's behalf.

App access does not paper over missing agent access. That is the answer I was hoping for.

Memory and learning

As a Claw works through a long-running session, it keeps notes to manage memory and context. Across runs, it applies what Oracle described as procedural or functional learning, so later runs of the same outcome can make fewer LLM calls, use fewer tokens, and produce better results.

Another of our architects asked where that learning lives. The answer was direct: it is tenant-centric and specific to the Claw outcome. It is not a shared, Oracle-wide learning layer.

Why it took this long

I said on the call that the open Claw concept has been around for a while, and that the real challenge was never the concept. It was constraining it.

Oracle agreed. Their point was that no customer wants a Claw going wild in their environment and picking up permissions it is not supposed to have, and that this is a deliberately constrained implementation built to work within Fusion security. Having heard the details, I believe them.

What we did not cover

A few things I still want to understand, and which are now with Oracle as written follow-up questions:

·        What the Outcome Receipt described in the announcement contains in practice, where it is stored, and whether it can be exported to the systems we already use for audit.

·        Whether code generated by the Claw is logged and reviewable after the fact.

·        How the user's identity is handled across sessions that run for hours or days, including what happens if that user's roles change mid-run.

·        Where business data retrieved into the container is held during the retention period, and how it is purged.

None of those are criticisms. They are the questions an audit or architecture review board will ask, and I would rather have them answered before anyone needs them and I'll report back with what we find!

Based on a working session between our team and Oracle's Fusion AI product management group in October 2026, combined with Oracle's public announcement of Fusion Claw on September 29, 2026 and Oracle's public documentation. Product details and pricing mechanics change between releases. Confirm specifics against your own environment, rate card, and Oracle account team. Views are my own.

Fusion Claw Does Not Replace Agentic Apps. It Gives Them a Longer Reach.

Fusion Claw Does Not Replace Agentic Apps. It Gives Them a Longer Reach.

Where Oracle's newest Fusion AI capability actually sits relative to Agent Studio, workflow agents, and agentic apps.

In August I wrote about sorting out where AI Agent Studio ends and agentic apps begin. A few weeks later, on September 29, Oracle announced Fusion Claw, and my feed has had something new about it nearly every day since.

The reaction on my team was the same one we had last time: what is this, and what does it do to everything we just learned?

So we went back to Oracle's Fusion AI product management team and asked exactly that.

The short answer

Fusion Claw is not a new place to build agents, and it is not a replacement for agentic apps. It is a governed runtime that an agentic app can use for a specific class of work: long-running, outcome-driven, and often data-heavy.

When I summarized it back on the call as a governed agentic execution runtime that agentic apps can leverage, rather than something doing work on its own, Oracle agreed with the framing. They added one refinement that turns out to matter a great deal, and I will get to it in a moment.

Oracle also confirmed what the name suggests. The architecture and concept are inspired by OpenClaw, NemoClaw, and similar approaches. What they built around that concept is considerably more governed, which I will cover in a separate post.

The hierarchy, restated

The cleanest way to understand Fusion Claw is as a third layer on top of the two we already had.

·        Workflow agents perform a specific, well-defined task. The example used in our session was taking a purchase order from an email and turning it into an invoice.

·        Agentic apps combine those agents into a team with shared context and memory, coordinated by an orchestrator, working toward a broader business outcome in near real time.

·        Claw outcomes are presented inside an agentic app as an explicitly defined business goal, described in natural language and powered by a skill that tells the Claw how it may use the agents and capabilities the app exposes.

One of our architects pushed back during the call and asked whether we had the direction backwards. The clarification was helpful. Agents are designed to work independently. The agentic app combines them into a team. The Claw is then presented through that app as an outcome. It can orchestrate against the team, but its scope is the app.

The refinement: the Claw plans, the agents execute

This is the part I would underline.

The Claw does the planning and orchestration. When it is time to actually do something in Fusion, it calls back through the agentic app to the agents to perform the execution. The Claw itself does not hold authentication credentials and does not directly perform authenticated business transactions.

That separation shapes how you should think about governance, and it is why I keep describing this as a runtime rather than a new kind of agent.

What it adds on top of an agentic app

One of our architects asked the obvious question: agentic apps already orchestrate agents, so what does a Claw add? Oracle's answer came down to four things.

1.      An explicit business goal. In an agentic app, the capability is implicit in the agents you selected and the tasks users ask of them. With a Claw, the author or user states a specific outcome, and progress is tracked toward completing it.

2.      Long-running sessions. A Claw session has a heartbeat. It can wake up, continue working, and make progress toward the outcome over minutes, hours, or days, incorporating feedback from the user where needed. Oracle compared it to deep research tools where you hand over a large ask and it works through a plan.

3.      Large data and generated code. The Claw can retrieve authorized business object data, potentially millions of records, and write code behind the scenes to analyze it. That code runs in a private container rather than directly in Fusion. The example offered was evaluating supply chain routes ahead of an upcoming event or a supplier shortage. Oracle was clear that this is not something an agentic app does out of the box.

4.      Self-learning. The runtime keeps notes and memory as it works, so subsequent runs of the same outcome can use fewer LLM calls and fewer tokens while improving quality. That learning is tenant-specific and tied to the particular outcome.

This connects directly to something I flagged in August. I wrote then that agentic apps enforce a 60 second response limit and that it is a real design constraint. Oracle described the agentic app interaction as point in time: to see updated state, you invoke the app, and then you tell it what to do next. When I asked whether long-running reasoning beyond that point-in-time interaction was the real value of the Claw, the answer was yes. Fusion Claw is what Oracle built for work that does not fit that shape.

Where you will actually see it

There is no separate Claw interface. Inside an agentic app there is an outcomes section, and available Claws are presented there as business goals. An authorized user picks one and starts it.

Behind that, the author defines the outcome: the skills, the capabilities it can use, the security constraints, and the guardrails. That package is what gets instantiated into a container when an authorized end user kicks it off. Authors decide what the Claw can do. Users with the right roles get to run it.

One of our team members asked specifically whether this created a separate path in. It does not. The agentic app is the way in.

What Oracle shipped

Oracle's announcement introduced 25 Claw-powered agentic applications, part of a portfolio of 75 agentic applications. The examples it called out span the suite:

·        Ledger for close readiness and accounting exceptions

·        Workforce Staffing for staffing plans that balance skills, availability, labor rules, and cost

·        Shipping Consolidation for modeling consolidation alternatives in supply chain

·        Account Territory Growth Plan for sales territory and opportunity allocation scenarios

The announcement describes each outcome as starting with a frontier model that reasons and plans, with deterministic enterprise computation handling execution at scale. It also describes a range of automation levels, from quick assistance to governed full auto within explicitly delegated authority.

Where this leaves your investment

My advice from August holds, and if anything it is stronger now.

A Claw is only as capable as the agents and capabilities its agentic app exposes. Well-built workflow agents matter more with Fusion Claw, not less. Agent Studio remains the foundation.

Build workflow agents first. Assemble them into agentic apps once you have components worth assembling. Then look at which of your outcomes genuinely need long-running, data-heavy work, and those are your Claw candidates.

What I am still watching

·        How much outcome authoring is open to customers on their own agentic apps compared with the Oracle-delivered Claw-powered apps, and how customer changes to delivered apps carry forward through quarterly updates.

·        How the governance terms in the announcement, the Enterprise Operating Envelope, the Outcome Trust Harness, and the Outcome Receipt, map to what you actually configure. We discussed the outcome definition in detail. We did not get into the Outcome Receipt.

Both are on the list of follow-up questions we sent to Oracle. I will write about the answers when I have them.

Based on a working session between our team and Oracle's Fusion AI product management group in October 2026, combined with Oracle's public announcement of Fusion Claw on September 29, 2026 and Oracle's public documentation. Product details and pricing mechanics change between releases. Confirm specifics against your own environment, rate card, and Oracle account team. Views are my own.

Tuesday, June 9, 2026

Building an AI-Driven Oracle Fusion Cloud Analysis Tool: What We Learned Along the Way

If you work with Oracle Fusion Cloud and have ever felt like you need more insights when it comes to data quality, process health, or IDR performance, you are not alone. The Oracle ecosystem is rich, but the gap between "we have the data" and "we actually understand what the data is telling us" can be enormous. This post walks through how we built a Python-based analysis pipeline called Catalyst AI Lab that connects directly to Oracle Fusion Cloud REST APIs and surfaces actionable findings automatically, and how AI-assisted development made the whole thing possible in a fraction of the time it would have taken otherwise.

The Problem Worth Solving

Our team supports Oracle Fusion Cloud across ERP, EPM and HCM. Like most teams, we spent a lot of time answering the same questions: Why is our Straight-Through Processing rate lower than expected? Are there duplicate suppliers in the system? Which business units have the most unresolved invoice holds, and how old are those holds? Among many other existential questions!

The answers exist in Oracle. The REST APIs are well-documented enough to get started. But building something repeatable and systematic that could answer these questions reliably, across environments, and produce a report someone could actually act on -- that is a different project entirely.

The goal was to build a tool that behaves like a knowledgeable consultant running a discovery engagement: it goes into the system, looks at the data from multiple angles, identifies what is worth paying attention to, and tells you why it matters.

The Architecture: Discovery Lenses

We organized the analysis into what I call discovery lenses. Each lens is a focused analytical perspective that targets a specific domain. The IDR Invoice Processing lens, for example, looks at STP rates, hold root causes, duplicate invoices, supplier-level IDR success, and per-BU performance breakdowns. The Supplier Data Quality lens looks at the entire supplier master for duplicates, missing site attributes, banking configuration gaps, tax registration coverage, and cross-BU payment term consistency.

Each lens follows the same pattern: connect to Oracle, fetch the relevant data via REST API, run analysis, produce structured findings with severity levels, confidence scores, and remediation guidance, then export everything to an HTML report and supporting CSV files for drill-down in Excel.

The framework is extensible. Adding a new lens means creating one Python file, decorating a class with @register_lens, and adding configuration to a YAML file. No changes to the core pipeline needed.

Agentic Development: What It Actually Looks Like

I want to be honest about what AI-assisted development meant on this project, because there is a lot of noise around this topic.

The GitHub Copilot agent in VS Code was not just writing boilerplate. I was having extended conversations with it about Oracle API behavior, asking it to review findings for accuracy, having it run the pipeline against our dev environment and then analyze the results, and using it to write and fix tests. When a finding was surfaced with a remediation recommendation that turned out to be wrong (more on that below), we flagged it, the agent researched the correct Oracle Cloud guidance, and we updated both the code and the best practices configuration together.

The workflow looked like this: I would describe what I wanted to understand about the data. The agent would research the Oracle REST API structure, write the lens code, run the pipeline, and report back with results. Then we would review the output together, identify what was accurate, what was misleading, and what needed more nuance. That iterative loop is where the real value was. It compressed weeks of work into days.

The test suite ended up at 632 tests covering pagination behavior, finding logic, report generation, CLI commands, and end-to-end pipeline execution. Having the agent write those tests alongside the features meant I could refactor confidently.

Oracle REST API: Things You Will Not Find in the Quick Start

This is the section I wish existed when we started.

First, pagination. Oracle Fusion Cloud REST APIs use offset/limit pagination with a default page size of 100 records. That is straightforward. What is not obvious is that if you want Oracle to tell you how many total records exist, you have to explicitly pass totalResults=true as a query parameter on your request. Without it, the API returns your page of data but gives you no indication of the overall population size. We were calculating STP rates against a 20,000-invoice sample before realizing we had 275,180 invoices YTD. That is a 7.3% sample, which changes how you interpret the findings significantly.

The fix was simple once we understood it: on the first page request, add totalResults=true to the query string. Oracle then returns the estimated row count in the response, and you can surface that alongside your findings as a population coverage metric. Every finding now shows something like "analyzed 20,000 of 275,180 invoices (7.3% coverage)" so the reader understands the confidence level of what they are seeing.

Second, filter syntax on certain resources. Oracle's REST API supports query filters using a SCQL-style syntax, which is powerful for many resources. But for invoiceHolds specifically, we discovered that compound filters with semicolons are silently ignored. You cannot filter by multiple conditions in a single request on that resource. The API accepts the request without error, applies no filter at all, and returns unfiltered data. If you are not paying attention, you will think your filter worked and analyze the wrong dataset. The workaround is to fetch the broader dataset and filter in application code.

Third, the OpenAPI specification files for Oracle Fusion Cloud are enormous. The five files covering ERP Financials, PPM, Procurement, Common, and HCM total nearly 400MB. You cannot parse those with standard JSON libraries without running into memory issues. The solution was ijson, a streaming JSON parser that lets you walk through the spec without loading it all into memory at once.

Fourth, credentials. Oracle Cloud API credentials need to be stored securely. The pipeline uses OS keyring integration (Windows Credential Manager on Windows, Keychain on Mac) so passwords are never in plain text files, never in environment variables that might get logged, and never in source control. This is worth doing properly from the start because once you have multiple environments and multiple team members, credential hygiene matters.

What the Analysis Actually Found

Running the full pipeline against our Prod clone environment produced some results worth highlighting, both because they illustrate what this kind of tool can surface and because they validate the approach. Below are a couple of material examples.

On the IDR side: our overall STP rate looked reasonable at the summary level, but the per-BU breakdown showed significant variance. Several business units were well below the industry benchmark. That variance was invisible in aggregate reporting. The hold analysis showed issues, which is a cash flow concern that should have been caught in normal operations.

On the supplier side: analyzing all suppliers at 100% population coverage found many potential duplicate supplier groups, duplicate addresses, and active suppliers flagged as Do Not Use. The real value is that the tool gives you a prioritized, evidence-backed list to work through rather than asking someone to manually review a spreadsheet with thousands of rows.


Click on the image to expand it~

Lessons on Accuracy and Iteration

One thing I want to be direct about: the first version of several remediation recommendations in the tool were wrong. Not wrong in a subtle way -- wrong in the sense that they referenced Oracle lookup values that do not exist in standard Cloud instances, or recommended configuration changes that would break other functionality.

This happened because the AI was drawing on general Oracle knowledge that did not perfectly match Oracle Cloud specifically. The fix was systematic: review every finding's remediation guidance against actual Oracle Cloud documentation and lived experience, update the best practices configuration file that drives the recommendations, and add tests that assert the correct guidance is present.

That iteration process is not a failure of AI-assisted development. It is how the process is supposed to work. The agent accelerates construction; human expertise and domain knowledge ensure correctness. If you skip the review step, you will ship wrong recommendations at scale. If you do the review, you end up with something accurate and fast.

How You Can Apply This to Your Environment

The pattern generalizes beyond the specific lenses we built. If you support Oracle Fusion Cloud in any capacity, you almost certainly have questions you are answering manually today that could be answered systematically with this approach.

Start with one question you care about. What is your PO-backed invoice percentage? How many suppliers have incomplete site setup? What is the distribution of expense report approval times across business units? Pick something with a clear Oracle REST API resource behind it, build a focused analysis around it, validate the results against what you know to be true, and iterate from there.

The Oracle REST API surface area is large enough that you can build meaningful analytics across almost any domain without needing a data warehouse, a separate reporting tool, or an extract from production. The data is there. The APIs are there. The AI tooling to help you build something coherent on top of them is better than it has ever been.

The repository for this project is internal to our organization, but the patterns, the Oracle API gotchas, and the architectural approach are all things you can apply independently. If you are working on something similar or have questions about the Oracle-specific pieces, drop a comment below. I am happy to go deeper on any of it.

How I Built an Oracle AI-Driven Support Tool for Oracle Cloud Using Databricks, OCI and Claude

If you've spent any time supporting Oracle Cloud ERP, HCM, or EPM, you already know the pattern. A user submits a ticket about a payroll element not processing. You ask a series of diagnostic questions. You identify whether it's an effective date problem, a payroll cutoff issue, a security profile gap, or one of a dozen other root causes. You document the fix. Two months later, a different user hits the same issue and the whole cycle starts over.

This post walks through a tool I built to break that cycle. It is called Solution Designer, and it uses an agentic AI approach on top of Databricks to give your Oracle support team structured, consistent, context-aware troubleshooting guidance -- without requiring users to know exactly what to ask.

The Problem With Generic AI for Oracle Support

The first instinct most teams have is to point users at a general-purpose chatbot. "Just ask it your Oracle question." The problem is that Oracle Cloud is enormous and deeply configuration-dependent. A question like "why isn't my payroll processing?" has radically different answers depending on element type, entry method, effective date, pay period status, and whether payroll has already been run for the period.

A generic chat interface puts all of that burden on the user. They have to know which details matter, phrase the question precisely, and interpret an answer that wasn't tuned to their specific setup.

I took a different approach. Instead of a free-form chat interface, I built a guided intake flow that collects the right diagnostic signals before the AI ever generates a response. The model then has full context to produce a solution that actually fits the situation.

What Solution Designer Does

At its core, the tool is a Flask application deployed as a Databricks App. It connects to OCI or Claude via the Databricks Foundation Model API or the OCI LLM API. The experience works like this:

1. The user picks a scenario from a categorized library. The library currently covers 31 Oracle scenarios across ERP (Payables, Procurement, Receivables, General Ledger, Fixed Assets, Inventory, Projects), HCM (Payroll, Absence, HCM Data Loader, Fast Formula, Security, Workforce Compensation), EPM (Consolidation, Planning Data Loads, Rule Troubleshooting), and integrations (REST API, FBDI, BI Publisher, OTBI, Workflow Notifications).

2. The tool presents a structured intake form specific to that scenario. For Payroll Element Entries, for example, the user answers eight targeted questions: what type of element, how it was created, the specific symptom, how many employees are affected, the effective date, the pay period, whether payroll has already run, and the current status of the element entry. Every question has help text explaining why it matters.

3. The scenario definition includes edge cases. Each scenario JSON file encodes known Oracle gotchas as conditional logic. If the effective date falls outside the pay period, the system flags that as a high-severity edge case and incorporates it into the prompt context automatically. If payroll already ran and the entry is still unprocessed, the tool knows to surface the rollback-or-next-period decision. Users do not have to discover these traps manually.

4. OCI or Claude generates a tailored solution. With the structured inputs and edge case context loaded, OCI/Claude produces a step-by-step resolution path that is specific to what the user actually described. This is not a generic knowledge article. It is a direct answer to their exact configuration.

5. The user can refine through follow-up questions. After the initial solution, the conversation stays open. Users can ask clarifying questions and the system maintains full session context so responses stay coherent. Sessions persist in a Unity Catalog Delta table so the conversation survives page refreshes and can be resumed later.

6. After rating the solution, the user can generate a training document. Once the problem is solved and the user rates the response, a "Generate Training Doc" button appears. They specify a format (Markdown, slide outline, or quick-start guide) and a target audience, and OCI/Claude turns the solution into a shareable knowledge artifact. This is where individual troubleshooting events compound into reusable organizational knowledge.

How the Knowledge Base Works

Each scenario is a JSON file that defines intake questions, answer options, help text, edge cases, and the conditions that trigger them. Here is a simplified example from the Payroll Element Entries scenario:

```json

{

  "id": "oracle-hcm-payroll-element-entries",

  "category": "Oracle HCM",

  "title": "Payroll Element Entries Not Processing",

  "intake_questions": [

    {

      "id": "effective_date",

      "question": "What is the effective date of the entry?",

      "type": "text",

      "required": true,

      "help_text": "Enter date in format MM/DD/YYYY - must be within pay period"

    }

  ],

  "edge_cases": [

    {

      "condition": "effective_date outside of pay_period",

      "impact": "Entry will not process in expected period. Must match effective date to pay period or entry will be skipped.",

      "severity": "high"

    }

  ]

}

```

This structure means the expertise lives in the JSON, not in the prompt. Adding a new scenario or a new edge case is a file edit, not a code change. The knowledge base hot-reloads, so updates go live without a restart.

The Architecture on Databricks

Running this on Databricks was a deliberate choice. The team already uses the platform, so authentication, security, and data governance come for free. Here is the technical stack:

- Databricks Apps for hosting the Flask application

- Databricks Foundation Model API to call Claude (Sonnet 4.5 at time of writing) without managing any external API credentials or you can use the OCI LLM API and connect to it using Python from within the solution

- Unity Catalog Delta tables for two purposes: structured logging of every interaction to `ef_dv.raw_dev_metadata.solution_designer_logs`, and session persistence in `ef_dv.raw_dev_metadata.conversation_sessions`

- Serverless SQL Warehouse for querying those Delta tables from the app

- On-behalf-of (OBO) authentication so every request to Databricks runs under the identity of the actual user, not a shared service account

The logging design deserves a mention. Every time a user generates a solution, submits feedback, or asks a follow-up question, a structured record lands in the Delta table with fields for user identity, scenario ID, scenario category, satisfaction rating, time saved, duration, and the interaction text. That gives leadership a real ROI dashboard backed by queryable data rather than estimates.

How We Built This With Agentic Development

The development process itself is worth describing because it reflects a pattern that works well for Oracle-specific tooling.

We used GitHub Copilot in agent mode throughout the build. The agent did not just autocomplete code; it was given feature requirements and asked to reason through the implementation, identify edge cases in its own output, and iterate. The key discipline was keeping the agent's scope narrow. Each session had one focused objective: add session persistence, add the feedback loop, fix a specific datetime bug in Delta table reads, resolve an issue with the resume-session banner showing stale state.

This approach works well for Oracle support tooling for a specific reason: Oracle Cloud problems are well-bounded. The diagnostic questions for a 3-way match hold resolution are not the same as the diagnostic questions for an HCM Fast Formula error. That domain specificity is an asset when working with an AI coding agent because you can describe the scenario structure precisely and the agent can reason about it correctly.

The iterative cycle looked like this:

1. Identify a gap in the user experience (example: returning to a previously solved scenario still presented the rating form instead of the completed state).

2. Trace the root cause through the code. In this case, the `/feedback` endpoint stored the rating on the session's last interaction in the Delta table but intentionally left session status as `active`. The frontend never checked whether the last interaction already had feedback attached.

3. Write a targeted fix. The solution was a new `restoreFeedbackStateFromHistory()` function in the frontend that reads the persisted rating, locks the feedback buttons, skips the rating form, and surfaces the "Generate Training Doc" button directly. No backend changes needed.

4. Run the 329-test suite to verify no regressions.

5. Deploy with the PowerShell script that syncs files to the Databricks workspace and triggers a new app deployment.

6. Confirm SUCCEEDED in the Databricks Apps deployment status.

The agent accelerated every step but did not replace the domain judgment calls. Decisions like "should the session status flip to solved when feedback is submitted, or should we leave it active so users can keep the conversation going?" require understanding the Oracle support workflow. The agent implements whatever direction you give it; you still have to give the right direction.

What This Looks Like in Practice

Consider a real scenario: an Oracle Finance team is getting 3-way match holds on vendor invoices. Previously, a ticket would come in, a knowledgeable team member would spend 15 to 45 minutes asking diagnostic questions via email or a Teams chat, and then write up a resolution.

With Solution Designer, the user navigates to the "3-Way Match Hold Resolution in Payables" scenario. They answer questions about hold type (quantity vs. price variance), tolerance settings, receipt status, PO type, and approval status. The tool detects relevant edge cases -- for example, if it is a price variance hold on a blanket PO, there is a specific Oracle behavior around line-level vs. header-level tolerances that trips people up repeatedly. The solution it generates addresses exactly that combination. If the user is satisfied, they rate the response, click "Generate Training Doc," specify their audience as "Oracle Finance users," and download a formatted guide they can drop into their SharePoint or Confluence space.

The time saved compounds across every person who hits that scenario going forward.





Click on the Images to Expand Them~

What We Learned

A few things stand out after building this:

Structure beats prompting. The quality improvement from giving AI structured inputs with pre-evaluated edge cases is larger than any prompt engineering trick. When the model knows that the effective date is outside the pay period because the scenario definition explicitly flagged it, the response is categorically more useful than when the user tries to describe that situation in free text.

Persistence changes the support dynamic. When solutions survive as resumable sessions in Delta, the tool stops being a one-shot query tool and starts being a case management layer. Users come back to the same session when a problem resurfaces, add follow-up context, and build a richer record of what was tried and what worked.

Feedback closes the loop. The satisfaction ratings and time-saved estimates that land in the Delta log are not vanity metrics. They identify which scenarios are working and which ones need better edge case coverage. The scenarios with low success rates are the ones that need a knowledge base update. That is a tractable engineering task.

Domain expertise encodes well into JSON. Oracle Cloud has well-documented configuration patterns and well-known failure modes. That knowledge, once captured in the scenario JSON format, is reusable forever. An experienced Oracle consultant or admin can encode years of diagnostic heuristics in an afternoon and make them available to everyone on the team immediately.

Getting Started If You Want to Build Something Similar

The approach is not specific to this stack. The core pattern is: structured intake + knowledge-encoded edge cases + LLM synthesis + persistent sessions. You need:

- A way to call a capable LLM (Databricks Foundation Model API, OCI LLM, Azure OpenAI, or similar)

- A JSON or database structure to encode your domain knowledge

- A lightweight web framework (Flask works well; FastAPI is another good option)

- A persistence layer for sessions and logs (Delta on Databricks is convenient if you are already there; a Postgres database works just as well and of course OCI Autonomous Databases!)

If your organization runs Oracle Cloud and has people who have been troubleshooting it for years, you already have the hardest ingredient: the domain knowledge. The tool just gives you a way to make it available at scale.

The knowledge base for this project started with five scenarios based on the most frequent support tickets. It now covers 31. Each new scenario takes roughly two to four hours to build out properly, including the edge cases. That is a reasonable investment for a scenario that generates 20 support tickets a month.

If you are building something similar for your Oracle user community, the questions, edge case structures, and session management patterns described here translate directly. The specific scenarios are where your team's expertise goes -- everything else is scaffolding.

Monday, June 8, 2026

How I Connected Oracle OCI LLM Endpoints to Postman and VS Code

I recently spent some time wiring up Oracle Cloud Infrastructure Generative AI endpoints so I could call models directly with an OCI Generative AI API key, validate everything in Postman, and then take the same setup into Visual Studio Code. The process ended up being a great example of how OCI can fit into modern AI workflows without forcing teams to abandon the tools they already use every day. Oracle’s Generative AI service supports service specific API keys, OpenAI compatible endpoints, and both Chat Completions and Responses APIs, which makes it much easier to integrate enterprise hosted models into familiar developer tooling.

What stood out to me most was how practical the setup became once the moving parts were understood. OCI Generative AI API keys are not the same as standard OCI IAM API keys. They are service generated secrets created specifically for OCI Generative AI, and Oracle documents that either of the two generated secrets can be used interchangeably in the Authorization header when calling supported model endpoints in the same region where the key was created.

Step 1: Creating the OCI Generative AI API Key

The first step was creating an API key inside the OCI Generative AI area of the Oracle Cloud console. Oracle documents these as service specific credentials for model access, and that distinction matters because they are meant for LLM endpoint authentication, not for general tenancy administration. Oracle also notes that the key must be used in the same OCI region as the model endpoint, which is important when you are testing against a region specific inference URL.

Another helpful detail is that OCI gives you two interchangeable secrets per API key. That makes rotation easier because one secret can be regenerated while the other remains active. Oracle explicitly recommends using one of those secrets as the bearer token when calling a supported model endpoint.

Step 2: Adding the IAM Policy That Makes the Key Work

Creating the API key was only part of the story. The key also needed permission to call the OCI Generative AI service. Oracle’s documentation explains that a separate IAM policy is required for principals of type generativeaiapikey, and this is where a lot of integration attempts can stall if the policy step is skipped.

In my case, I created the policy in the OCI Console under *Identity & Security > Policies* and used the manual editor in the root compartment. For testing, the policy that finally unlocked the flow was:

```text

allow any-user to use generative-ai-family in tenancy where ALL {request.principal.type='generativeaiapikey'}

```

Oracle documents this pattern for broad testing access and also explains that policies can be narrowed later by compartment, model, operation type, or even a specific API key OCID. That is a good way to start wide enough to validate the integration and then tighten the scope after the path is proven.

Step 3: Calling the OCI Endpoint from Postman

Once the key and policy were in place, I moved into Postman. Oracle documents a REST endpoint pattern for Chat Completions using OCI Generative AI API keys:

```text

https://inference.generativeai.<region>.oci.oraclecloud.com/20231130/actions/v1/chat/completions

```

Oracle’s API key documentation also shows that the request should send the API key secret in the Authorization: Bearer ... header and include a valid supported model in the request body. Supported models for this API key based REST path include xAI Grok and OpenAI GPT OSS, which are the models I focused on, but there's more available models in OCI like Llama, Cohere and Gemini.

My working request in Postman ended up looking like this:

```http

POST https://inference.generativeai.us-chicago-1.oci.oraclecloud.com/20231130/actions/v1/chat/completions

Authorization: Bearer sk-<your-secret>

Content-Type: application/json

Accept: application/json

```

With a body like this:

```json

{

  "model": "openai.gpt-oss-20b",

  "messages": [

    {

      "role": "user",

      "content": "Say hello in one sentence."

    }

  ]

}

```

After the policy was added, that request returned a successful response. That was the turning point because it confirmed the key, the policy, the endpoint, and the region were all aligned correctly. Oracle’s documentation supports this exact pattern, including the Chat Completions endpoint and the use of a bearer token generated by OCI Generative AI.


Click the image to expand it~

What I Learned From the Postman Troubleshooting

The troubleshooting was actually a useful part of the exercise. Early failures came down to a few very specific issues. First, the bearer token has to be the actual `sk-...` secret, not the API key OCID or a console URL. Second, the key has to be used in the same region where it was created. Third, the IAM policy really is required or the request will not succeed even if the secret is correct. Oracle’s docs are clear on all three of those points, and once those pieces clicked, the flow became much more predictable.

That experience also reinforced something broader. OCI is not just exposing models in its own console. Oracle is making the service available in ways that work with the tools many engineering teams already use, which lowers the friction to experiment and integrate. Oracle’s newer OpenAI compatible endpoint documentation makes that intent even more obvious by describing a base endpoint that works with familiar OpenAI style request patterns while still keeping authentication, execution, and resource management inside OCI.

Step 4: Taking the Same OCI Endpoint into VS Code

After confirming the endpoint in Postman, I wanted the same model access inside Visual Studio Code, given it's broad use in our organization. That turned out to be possible using VS Code’s bring your own key model support. Microsoft’s documentation explains that VS Code lets you add language models through the model picker and that custom providers can expose one provider with many models. The model metadata includes fields such as id, name, maxInputTokens, maxOutputTokens, and capability flags like tool calling and image input.

Using the custom endpoint option in the VS Code model picker opened a configuration file where I defined the OCI model settings. I used a Chat Completions style configuration because I had already validated that path in Postman. The key pieces were the OCI endpoint URL, the OCI API key, and the exact model ID. For example, openai.gpt-oss-20b worked well for a first pass because it had already succeeded in Postman, and Oracle lists GPT OSS as a supported model family for API key based Chat Completions.

The result was that I could select the OCI backed model in VS Code’s chat experience and use it like any other language model available through the model picker. Microsoft documents that the model picker is how users switch chat models, and Oracle documents that OCI supports both native and OpenAI compatible inference patterns. That combination is what made this work so well.

Click the image to expand it~

Why This Matters

To me, the bigger takeaway is not just that I got Postman and VS Code working. It is that OCI can participate in the same AI development workflows people already use for testing, coding, prototyping, and experimentation. Oracle’s documentation highlights support for OpenAI compatible endpoints, supported SDKs, and familiar APIs like Chat Completions and Responses. Microsoft’s documentation shows that VS Code is increasingly flexible about model choice through bring your own key and custom providers. Put those together and you have a path for teams that want enterprise hosted AI models without giving up developer ergonomics.

That opens up a lot of possibilities. It means OCI hosted models can be validated in Postman, consumed by scripts and SDKs, and surfaced directly in the editor where developers work. It also means organizations that are already invested in Oracle can extend that platform into modern AI workflows instead of treating it as something separate. OCI Generative AI is positioned by Oracle as an enterprise scale AI platform that supports hosted models, OpenAI compatible APIs, governance, and agent related features. This kind of integration work shows what that can look like in practice.

Final Thoughts

What started as a simple attempt to call a model with an OCI API key turned into a good exercise in understanding how Oracle has structured access, authorization, and compatibility with recent product enhancements. The final setup was straightforward once the pieces were in place: create the API key, grant the IAM policy, validate the endpoint in Postman, and then carry the same working endpoint into VS Code. Oracle’s API key model, policy framework, and OpenAI compatible options make that path realistic, and it is a strong example of OCI being useful well beyond the console itself.

If you are working in OCI and want to make enterprise hosted LLMs available in tools your team already trusts, this is absolutely worth trying.

Sunday, March 16, 2025

Enhancing Oracle HCM Recruiting and Oracle Projects with Personalized Notifications

Effective communication is key to successful recruitment and project management. Oracle HCM offers robust tools for personalized notifications, ensuring that the right messages reach the right people at the right time. In this blog post, we'll explore how to leverage the Content Library and Alerts Composer for personalized notifications in Oracle HCM Recruiting, as well as configurable workflow notifications in Oracle Projects.

Personalized Notifications in Oracle HCM Recruiting

Oracle HCM Recruiting provides two primary methods for sending emails and worklist notifications:

  1. Content Library: This tool is primarily used for sending messages to candidates. Within the "send messages" feature, you can select templates that you've created in the Content Library. This allows for consistent and professional communication with candidates, enhancing their experience and engagement with your recruitment process.
  2. Alerts Composer: This tool can be used for internal notifications, such as emails to hiring managers. The Alerts Composer allows you to modify delivered alerts or create custom alerts with your own content. This flexibility was utilized during our ORC implementation to tailor notifications to specific needs, ensuring that internal stakeholders are always informed and up to date.
  3. Alerts composer can also be a powerful tool to send personalized emails in other situations and providing another alternative to those that rely heavily on BIP to send email alerts and acknowledgements. You can create custom alerts or modify out of the box alerts to change the email body’s and insert your own branding.
The below images show how to navigate to the candidate/recruiting content library and the templates created can then be selected when sending messages (second screenshot). The third screenshot shows the Alerts Composer, once you click on actions, you can see all you can do with the selected alert.

Click on the images for a full sized experience




In Summary, while the Content Library is specific to Oracle Recruiting, the Alerts Composer is a versatile tool within Oracle HCM. It enables you to modify standard alerts or create custom alerts for various scenarios, such as notifying employees when their driver's license is about to expire. For more details, you can refer to the Common Features for HCM documentation on the Alerts Composer.

Configurable Workflow Notifications in Oracle Projects

Oracle Projects also offers powerful tools for managing notifications. According to the documentation, the recommended approach is to modify the standard BIP (Business Intelligence Publisher) notification templates. This allows for a high degree of customization, ensuring that notifications are relevant and actionable.

Another option for ERP (Enterprise Resource Planning) is to use the ERP Business Event framework in conjunction with Oracle Integration Cloud (OIC). This setup allows you to listen to events and send personalized notifications. There is extensive support for various modules, including Payables and Projects. For example, you can use this framework to send acknowledgment emails by listening to FBDI (File-Based Data Import) business events. This is necessary because the Alerts Composer is an exclusive feature of Oracle HCM, and not of Oracle Projects.

Documentation:

Overview of Configurable Workflow Notifications in Project Management

Oracle ERP Cloud Adapter Capabilities

Conclusion

By leveraging the Content Library and Alerts Composer in Oracle HCM Recruiting, and the configurable workflow notifications in Oracle Projects, you can significantly enhance your communication strategy. These tools provide the flexibility and customization needed to ensure that your messages are timely, relevant, and effective. Whether you're communicating with candidates, hiring managers, or project stakeholders, Oracle HCM and Oracle Projects have the capabilities to support your needs.

Sunday, January 14, 2024

Oracle Integration Cloud Gen 3 Upgrade - Tips and Features

As some of you may be aware, Oracle is migrating their OIC Platform to its new generation, called OIC 3. For those that remember the Gen 1 to Gen 2 migration, this one is more impactful, delivering a significant overhaul from a UI and usability perspective, as well as many new features. This entry will cover some of the features that I am most excited about, as well as important links and other key information relative to the upgrade effort.

An overview of key highlights with opportunities is below, and detailed documentation to all new features and other information is available at the bottom via links. Also, new updates are being rolled out to OIC Gen3 every month.


Gen3 Feature Highlights

Opportunities

Large payload support for integrations

Payload support is growing with Gen3, which allows for more complex use cases and larger volume to be processed, which will be a win already, but also can eventually lead you to rationalizing other tools away, such as MuleSoft and Biztalk, if you use those platforms.

Enhanced Disaster Recovery Capabilities

Gen3 will have an enhanced Oracle Managed DR offering that should simplify and reduce manual labor versus our existing DR strategy in Gen2, more on that below.

Private Endpoint Connectivity

This feature will set the stage to deprecate the connectivity agent used in OIC to connect to the DBCS or ADB (autonomous database) where you may house PLSQL for complex business logic, and instead allows us to connect OIC to the Autonomous Database directly, and if you have your own tenant ADB for VBCS, then both can coexist.

In short, you can rationalize databases by removing the DBCS environments and consolidate VBCS and OIC into a single ATP (autonomous database), and while replacing the connectivity agent (third party) with an adapter (native), reducing technical debt and failure points, should you have this type of configuration in OIC 2 currently.

New recipes and adapters

Enhanced connectivity and opportunities both to accelerate development of new integrations and to reduce technical debt, such as custom integrations between OIC and custom identity or token providers.

Enhanced Event Framework

True pub sub capabilities will now exist in OIC, which will simplify when we use this pattern, as today we have to write parent/child integrations with custom hand offs, versus using native event capabilities internally in OIC. There also appear to be enhanced polling capabilities.

RBAC and Projects

This feature will enhance how you utilize global OIC environments across business units and teams, better allowing HR and AFT to co-exist on the same environment (for example), reducing risk and improving supportability. You can also move away from having independent Dev environments for HR and AFT or CX, and consolidate.

RPA Capability

RPA capabilities will be added to OIC, which will allow for the utilization of this feature to address RPA requirements and aid in removing dependencies with external tools and the utilization of less integrated and supported RPA capabilities, such as Blue Prism, in the context of the broader Oracle footprint.

Increased Observability

Changes to monitoring and API framework that will allow for enhanced monitoring capabilities.


To note:
  • Not all features in Gen2 may yet be available in Gen3, and this upgrade also impacts VBCS and Process Automation, so extensive testing will be required, including performance testing.
  • Oracle has mentioned that middle of next year will be the deadline to migrate, potentially August, and although initial research shows that many clients are still in Gen2 and that upgrade issues can happen, you should plan and execute this sooner than later.
  • Some of our features weren’t ready or fully developed in OIC 3, such as the VBCS auto upgrade, and other features, and also that there’s several break/fixes that have been completed to stabilize OIC 3. As an example, Oracle was tracking an internal bug relative to stage files read/write, and this had a performance difference compared to Gen2, as an example 20-minute runtimes would go to an hour or two, which highlights A) the need to check the Known issues link, but B) to perform extensive regression testing, and also performance testing.
  • I also recommend that you upgrade a single instance as a pilot, perform your test plans there, prior to moving to upgrading several environments at once.
  • The VBCS and PCS assets within your Gen 2 instance will now be part of the auto upgrade process, which was previously not available, and would have caused significant manual work on your end, however, there's some outstanding licensing concerns Oracle is working through in this regard and some updates have been postponed until February, but if you have a simple instance without VBCS or PCS, there's no reason to wait, and you can go to OIC 3 already.
  • Oracle utilized the auto upgrade process to internally upgrade many of their complex OIC assets in Q4 (which include VBCS and PCS), which has increased confidence in the process for those that will undertake the complex upgrade path.
  • We confirmed that the IDCS stripe that the Gen2 instance is related to will not be impacted by the upgrade, and that OIC instance names, URL’s, etc. will also not be impacted.
  • We confirmed the connectivity agent does have changes relative to how it authenticates (no longer supports basic authentication), but that it should be seamless during the upgrade process, but if you use a connectivity agent make sure to test it well.
  • When you login to your Gen 2 environment, there will be a section that tells you if your environment meets the prerequisites to be upgraded, it is important these upgrade pre-checks pass, check the link below for more information. Also, if you don't want your environments to be auto upgraded if the pre-checks are met, it's important that you communicate with Oracle, to avoid surprises, you can raise an SR to postpone migrations.
  • Lastly, our current understanding is that the deadline to migrate to OIC 3 will be August of 2024, currently, but this could move depending on adoption and issues.

Links to Documentation:

Friday, May 19, 2023

Oracle FA - Credential Store Framework (CSF) Key Registration with Oracle Integration Cloud for Business Events

The purpose of this entry is to provide information regarding registering CSF keys and configuring connectivity between the Fusion based ERP application and Oracle OIC!

As discussed in prior entries, Cloud ERP provides business events which can be subscribed to by Oracle Integration. To enable the trust between OIC and ERP, in a FA-based SaaS instance, the outbound call of a webservice uses a OWSM security policy which retrieves the credentials for the call from a CSF Key.

Credential Store Framework (CSF) keys are credentials that use basic authentication (username and password) to certify the access of users and system components. Once the registration process is completed then the CSF keys will help to trigger the business events and call-backs from ERP to OIC, and after catching the event in OIC, we can apply our business logic and perform any other action, such as calling an external API, sending an email, writing the output to a database, and more.

For this to work we must create a local IDCS account with admin privileges in OIC, and use that ID in the CSF key configuration. We must note that Oracle now also has a token based alternative, but that will be covered in another entry.

To generate the CSF key, follow the below steps:

a. Login into the OIC instance with the user credentials and navigate to the Integration home page.

b. Click on the username from the top right corner of the OIC page and select About.

c. The CSF Key will be generated by appending the identity domain and OIC admin. The format for the csf key generation is mentioned in the below table.


Format: <Identity Domain><Service Instance>

Now, follow the step by step process to configure CSF key:

a. Navigate to Oracle ERP SOA Composer to configure CSF key from the below mentioned url.

b. SOA Composer URL - https://<erphostname>/soa/composer

c. Login to the cloud application with your Oracle Cloud ERP user credentials

Note that you will need the following two roles, to perform the following actions:

SOA_OPERATOR_ROLE_JOB
SOA_DESIGNER_ROLE_JOB

d. Once the login is successful then click on the Manage Security from the right side of the page. Then click on the Manage Security and another popup will be open to provide the Manage Credentials details. Please refer to the below table to provide the Manage Credentials details.

Once the details are provided then click on the Register button to complete configuring the CSF KEY.

#

Element

Description

value

1

csf-key

Specify the csf key as extracted from the section before.

<Identity Domain><Service Instance>

2

User Name

Enter the OIC admin user name

Local account we talked about earlier.

3

Password

 

Enter the password for accessing OIC application

<PASSWORD>

4

Confirm Password

Renter the same password for second time

<PASSWORD>


Now it's time to verify the configuration has been done successfully.

Once the CSF Key configuration is completed then the CSF Key verification should be done.

a. Access the below mentioned FA Cloud instance by executing the following URL in a browser.

NOTE – Access the Event Subscription URL from IE, Firefox or Edge Browsers. Do not use Google Chrome browser
 
b. Event Subscription URL – https://<erphostname>/ soa-infra/PublicEvent/subscriptions

If the event subscription url doesn’t work from the browser, then use the same URL in Postman to test it.

In the basic authentication section in Postman, pass the credentials for the local user and run the endpoint.

With this, OIC will now be able to listen to business events from ERP. One additional point to note, if you ever change the password for the account used for this setup, this trust will be broken. Also, rather than using the "update" option when changing the password and following these steps, you have to "register" again, because the changes won't take effect due to caching.