Oracle Select AI can now call Gemini Enterprise—but the cross-cloud credential becomes an operating dependency
The new provider option reaches Google models through Oracle’s existing NL-to-SQL interface, while OAuth refresh tokens, session policy and regional endpoints create a new failure surface.
Oracle has added Gemini Enterprise Agent Platform as an AI provider for Select AI in Autonomous AI Database Serverless. The integration applies to natural-language-to-SQL generation, chat, showsql, explainsql, embeddings and other Select AI capabilities, while preserving Select AI’s existing database-side interfaces. That makes the release more than another model choice: it lets an Oracle-resident text-to-SQL workflow use models available to a customer’s Google Cloud project and region. Oracle release note
The provider changes; the database contract does not
Select AI profiles define the database objects exposed to natural-language queries and can use table names, column names, data types and comments as metadata. Oracle’s profile mechanism also covers SQL generation and execution, SQL explanation, chat, retrieval-augmented generation and embeddings. The Gemini Enterprise option therefore sits behind an existing profile boundary rather than requiring teams to rebuild their database-facing application around a separate Google agent endpoint. Oracle profile documentation
The supported model surface is narrower than the platform name may suggest. Oracle says Select AI supports published Google Gemini models using the generateContent API and published Gemini embedding models using embedContent. Models served through other inference APIs—including Models as a Service, partner models and open models—are not supported through this integration. The selected region must also support the endpoint and model. Oracle profile documentation
OAuth is now part of query reliability
The practical boundary is authentication. Oracle documents Google Cloud OAuth 2.0 rather than a simple static API key for this provider. An operator creates Application Default Credentials with gcloud auth application-default login, then stores the resulting refresh token, client ID and client secret in the database credential used by the Select AI profile. Oracle explicitly warns that these values must not be committed to source control or included in logs or documentation. Oracle profile documentation
That credential also inherits Google organization session policy. Oracle notes that periodic reauthentication controls can invalidate the refresh token when a session expires, producing an invalid_grant response with an invalid_rapt subtype; restoring service requires running the application-default login flow again. Network policy must allow the regional aiplatform.googleapis.com endpoint, or the global endpoint for multi-region applications. Oracle profile documentation
For production teams, the migration checklist is therefore not just model quality and cost. It should include credential ownership, token rotation and reauthentication runbooks, endpoint allowlists, region compatibility, and monitoring that distinguishes an expired Google session from a bad SQL generation. The release keeps the application interface stable, but it makes cross-cloud identity part of the availability path for every generated query.
sources
comments · 0