Oracle Fusion AI Agent Studio is a platform that enables us to create and deploy AI Agents from within the Fusion environment.
With this platform, we can easily utilize the preconfigured agents and also build our own custom agents from scratch.
Since this platform is implicitly integrated into the Oracle Fusion applications environment, it facilitates the seamless access to Fusion business objects, APIs, and other tools pertaining to Fusion applications.
In this blog, I will cover the initial security configurations that help enable the AI Agent Studio within a given Fusion Environment.
Enable Profile Option
- Navigate to Setup and Maintenance
- Search for the task 'Manage Administrator Profile Values'
- Search for Profile Option Code 'ORA_ASE_SAS_INTEGRATION_ENABLED'
- Set the Site level value to Yes
- Save and Close
Submit ESS Jobs
- Navigate to Tools -> Scheduled Processes
- Submit the job Import Resource Application Security Data
- Once completed, submit the job Import User and Role Application Security Data
Create Custom Role
- Now, let's create a custom role that would give administrator access for HCM business area
- Navigate to Tools -> Security Console
- Create a new role and give a desired name
- Make sure to Enable Permission Groups for this role
- You will be shown a pop-up asking for confirmation. Click Enabled Permission Groups
- Once enabled, you should see a grayed-out checkbox confirming that the permission groups are enabled
- Click Next
- Go to Role Hierarchy (5) tab in the train
- Under Roles and Privileges tab, click Add Role
- In the popup window, search for role code ORA_HRC_HCM_AI_AGENT_MANAGEMENT_DUTY
- Select and click Add Role Membership
- Click Cancel to close the popup
- Navigate to the Roles and Permission Groups tab
- Click Add Role
- In the popup window, search for role code ORA_DR_FAI_GENERATIVE_AI_AGENT_HCM_ADMINISTRATOR_DUTY
- Select and click Add Role Membership
- Click Cancel to close the popup
- Navigate to Users (7) tab in the train
- Assign this role to the desired user
- Click Next
- Save and Close
With this configuration, we have successfully configured the security around AI Agent Studio for HCM business area and provided access to the desired user.
But we are not done yet. We need to do a few more configurations to make sure the administrator can access all the features of the studio, such as External REST API and AI Chat capabilities.
External REST API access
- External REST API configuration access is abled via TRAP (Token Relay And Proxy). TRAP handles the external REST calls with secure access.
- To enable this, navigate to Security Console
- Edit the custom role we just created 'AI AGENT STUDIO HCM ADMINISTRATOR'
- Go to Function Security Policies (2) tab in the train
- Under Privileges tab, click Add Function Security Policy
- Search for privilege ORA_FND_TRAP_PRIV
- Select and click Add Privilege to Role
- Click cancel to close the popup
AI Chat Access
- To provide AI Chat access, while you are in Function Security Policies tab, click Add Function Security Policy again
- Search for policy HRC_ACCESS_AI_AGENT_CHAT_PRIV and click Add Privilege to Role
- Click cancel to close the popup
- Now, let's navigate to Role Hierarchy (5) tab in the train
- Go to Role and Permission Groups tab
- Click Add Role
- Search for ORA_DR_FAI_GENERATIVE_AI_AGENT_RUNTIME_DUTY and click Add Role Membership
- Click cancel to close the popup
With these steps, we've successfully provided all the necessary administration access to the desired admin user for the HCM business area in Fusion AI Agent Studio.
Custom Admin roles for other Business Areas
If we want to create custom admin roles for other business areas such as Procurement and Supply Chain etc. then we essentially have to follow the same steps as above but we'll have to use different Privileges and Permission Groups.
Supply Chain Administration Configuration
- Follow the same steps as mentioned in 'Create Custom Role' section with following changes
- In Role Hierarchy section, under Roles and Privileges tab, assign below roles:
- ORA_RCS_SCM_AI_AGENT_MANAGEMENT_DUTY
- ORA_RCS_SCM_AI_AGENT_MANAGEMENT_DUTY_HCM
- Under Role and Permission Groups tab, assign below role:
- ORA_DR_FAI_GENERATIVE_AI_AGENT_SCM_ADMINISTRATOR_DUTY
Procurement Administration Configuration
- Follow the same steps as mentioned in 'Create Custom Role' section with following changes
- In Role Hierarchy section, under Roles and Privileges tab, assign below roles:
- ORA_PO_PRC_AI_AGENT_MANAGEMENT_DUTY
- ORA_PO_PRC_AI_AGENT_MANAGEMENT_DUTY_HCM
- Under Role and Permission Groups tab, assign below role:
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PRC_ADMINISTRATOR_DUTY
All Pillars Administration Configuration
- If we want to create a custom Administrator role that gives access to all business areas/pillars in the AI Agent Studio, then we need to use following roles and privileges.
- Follow the same steps as mentioned in 'Create Custom Role' section with following changes
- In Role Hierarchy section, under Roles and Privileges tab, assign below role:
- ORA_FAI_MANAGE_ALL_AI_AGENTS
With this platform, we can easily utilize the preconfigured agents and also build our own custom agents from scratch.
Since this platform is implicitly integrated into the Oracle Fusion applications environment, it facilitates the seamless access to Fusion business objects, APIs, and other tools pertaining to Fusion applications.
In this blog, I will cover the initial security configurations that help enable the AI Agent Studio within a given Fusion Environment.
Enable Profile Option
- Navigate to Setup and Maintenance
- Search for the task 'Manage Administrator Profile Values'
- Search for Profile Option Code 'ORA_ASE_SAS_INTEGRATION_ENABLED'
- Set the Site level value to Yes
- Save and Close
Submit ESS Jobs
- Navigate to Tools -> Scheduled Processes
- Submit the job Import Resource Application Security Data
- Once completed, submit the job Import User and Role Application Security Data
Create Custom Role
- Now, let's create a custom role that would give administrator access for HCM business area
- Navigate to Tools -> Security Console
- Create a new role and give a desired name
- Make sure to Enable Permission Groups for this role
- You will be shown a pop-up asking for confirmation. Click Enabled Permission Groups
- Once enabled, you should see a grayed-out checkbox confirming that the permission groups are enabled
- Click Next
- Go to Role Hierarchy (5) tab in the train
- Under Roles and Privileges tab, click Add Role
- In the popup window, search for role code ORA_HRC_HCM_AI_AGENT_MANAGEMENT_DUTY
- Select and click Add Role Membership
- Click Cancel to close the popup
- Navigate to the Roles and Permission Groups tab
- Click Add Role
- In the popup window, search for role code ORA_DR_FAI_GENERATIVE_AI_AGENT_HCM_ADMINISTRATOR_DUTY
- Select and click Add Role Membership
- Click Cancel to close the popup
- Navigate to Users (7) tab in the train
- Assign this role to the desired user
- Click Next
- Save and Close
With this configuration, we have successfully configured the security around AI Agent Studio for HCM business area and provided access to the desired user.
But we are not done yet. We need to do a few more configurations to make sure the administrator can access all the features of the studio, such as External REST API and AI Chat capabilities.
External REST API access
- External REST API configuration access is abled via TRAP (Token Relay And Proxy). TRAP handles the external REST calls with secure access.
- To enable this, navigate to Security Console
- Edit the custom role we just created 'AI AGENT STUDIO HCM ADMINISTRATOR'
- Go to Function Security Policies (2) tab in the train
- Under Privileges tab, click Add Function Security Policy
- Search for privilege ORA_FND_TRAP_PRIV
- Select and click Add Privilege to Role
- Click cancel to close the popup
AI Chat Access
- To provide AI Chat access, while you are in Function Security Policies tab, click Add Function Security Policy again
- Search for policy HRC_ACCESS_AI_AGENT_CHAT_PRIV and click Add Privilege to Role
- Click cancel to close the popup
- Now, let's navigate to Role Hierarchy (5) tab in the train
- Go to Role and Permission Groups tab
- Click Add Role
- Search for ORA_DR_FAI_GENERATIVE_AI_AGENT_RUNTIME_DUTY and click Add Role Membership
- Click cancel to close the popup
With these steps, we've successfully provided all the necessary administration access to the desired admin user for the HCM business area in Fusion AI Agent Studio.
Custom Admin roles for other Business Areas
If we want to create custom admin roles for other business areas such as Procurement and Supply Chain etc. then we essentially have to follow the same steps as above but we'll have to use different Privileges and Permission Groups.
Supply Chain Administration Configuration
- Follow the same steps as mentioned in 'Create Custom Role' section with following changes
- In Role Hierarchy section, under Roles and Privileges tab, assign below roles:
- ORA_RCS_SCM_AI_AGENT_MANAGEMENT_DUTY
- ORA_RCS_SCM_AI_AGENT_MANAGEMENT_DUTY_HCM
- Under Role and Permission Groups tab, assign below role:
- ORA_DR_FAI_GENERATIVE_AI_AGENT_SCM_ADMINISTRATOR_DUTY
Procurement Administration Configuration
- Follow the same steps as mentioned in 'Create Custom Role' section with following changes
- In Role Hierarchy section, under Roles and Privileges tab, assign below roles:
- ORA_PO_PRC_AI_AGENT_MANAGEMENT_DUTY
- ORA_PO_PRC_AI_AGENT_MANAGEMENT_DUTY_HCM
- Under Role and Permission Groups tab, assign below role:
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PRC_ADMINISTRATOR_DUTY
All Pillars Administration Configuration
- If we want to create a custom Administrator role that gives access to all business areas/pillars in the AI Agent Studio, then we need to use following roles and privileges.
- Follow the same steps as mentioned in 'Create Custom Role' section with following changes
- In Role Hierarchy section, under Roles and Privileges tab, assign below role:
- ORA_FAI_MANAGE_ALL_AI_AGENTS
- Under Role and Permission Groups tab, assign below role:
- ORA_DR_FAI_GENERATIVE_AI_AGENT_CX_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_FIN_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_GRC_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_HCM_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PRC_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PRJ_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PSC_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_SCM_ADMINISTRATOR_DUTY
End User AI Chat Access (Explorer Role)
- We need to create a separate custom role to provide only the AI Chat access to the end users, so that they can use the published AI Agents and interact with them.
- For this, simply follow the steps mentioned in 'AI Chat Access' section and assign the role to the desired end users.
With this, we have covered all the essential configurations to configure the security around AI Agent Studio administration as well as end user access and we should be able to access the studio to create and publish new agents.
We can access the AI Agent Studio from Tools menu
And we should be able to enter and access the platform as shown below:
The end users can access the published agents by navigating to Me -> AI Chat
The published agents will be ready to use and can be accessed from Explore tab in AI Chat
- ORA_DR_FAI_GENERATIVE_AI_AGENT_CX_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_FIN_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_GRC_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_HCM_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PRC_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PRJ_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_PSC_ADMINISTRATOR_DUTY
- ORA_DR_FAI_GENERATIVE_AI_AGENT_SCM_ADMINISTRATOR_DUTY
End User AI Chat Access (Explorer Role)
- We need to create a separate custom role to provide only the AI Chat access to the end users, so that they can use the published AI Agents and interact with them.
- For this, simply follow the steps mentioned in 'AI Chat Access' section and assign the role to the desired end users.
With this, we have covered all the essential configurations to configure the security around AI Agent Studio administration as well as end user access and we should be able to access the studio to create and publish new agents.
We can access the AI Agent Studio from Tools menu
And we should be able to enter and access the platform as shown below:
The end users can access the published agents by navigating to Me -> AI Chat
The published agents will be ready to use and can be accessed from Explore tab in AI Chat