live wire
▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake says Cortex Analyst apps keep working, but recommends Cortex Agents; semantic views and verified queries carry overSnowflake Documentation▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake says Cortex Analyst apps keep working, but recommends Cortex Agents; semantic views and verified queries carry overSnowflake Documentation
nl2sql.ai
guideACCESS CONTROL

Oracle’s shared Select AI teams separate workflow ownership from execution—but not from privileges

Cross-schema reuse narrows who can edit an agent team, while every consumer still needs the database and tool permissions required at runtime.

Shared team access is not the same as runtime privilege.
Side by side: what changed
By The News Desk· Oct 17, 2026the quick take — two AI hosts go live when you do

Oracle’s September release for Select AI Agent Framework teams solved a practical enterprise problem: one database schema can own an agent team, while users or roles in other schemas are granted permission to run it by an owner-qualified name. That makes a centrally maintained workflow reusable without copying its agents, tasks and tools into every consumer schema. But the privilege boundary is easy to misunderstand: permission to run the team is not permission to everything the team may touch.

The team is the unit of delegation

Oracle’s detailed sharing guide says the owner keeps control of the team definition—including workflow composition, task order, prompts and tool configuration. A consumer who receives access can run the shared team but cannot independently run or modify its underlying agents, tasks or tools, and cannot receive separate grants on those components through the team-access mechanism. Runtime values supplied through SET_TEAM or RUN_TEAM customize one execution without changing the stored definition.

That is a useful split for platform teams. The owner can update one governed workflow while consumers invoke the same version. It also reduces the chance that an application role quietly edits a prompt or swaps a tool while retaining the appearance of using the approved team.

Execution still uses the caller’s authority

The less obvious rule appears in Oracle’s prerequisites: DBMS_CLOUD_AI_AGENT uses the privileges of the user calling the package, and shared-team operations run with that caller’s privileges. A consumer therefore needs EXECUTE on the package and on any owner-defined PL/SQL tool functions that the team calls. External URLs require a credential object.

Oracle is explicit that GRANT_TEAM_ACCESS grants only permission to run the named team. It does not grant access to credentials, database objects, PL/SQL functions or other resources used by the workflow. Teams activated with SET_TEAM also require the owner to receive TRANSLATE SQL on the consumer user; without that grant, activation fails with insufficient privileges.

The deployment test

Treat a shared team as a versioned orchestration object, not as a security wrapper. Before rollout, test it under the actual consumer role—not the owner account—and inventory every database object, PL/SQL function, credential and translation grant needed by each path. Then revoke one dependency at a time and confirm that the failure is contained and auditable.

The operating model is therefore two-layered: team access decides who may invoke the workflow; ordinary database privileges decide what that invocation can actually do. Keeping those layers separate is the feature. Assuming the first layer implicitly supplies the second is the deployment bug.

sources

Filed by The News Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk