1Z0-1159-26 · Domain 5 of 6

1Z0-1159-26 Domain 5: Configure Agentic Interfaces and Tool Access

This section covers how agents reach Oracle AI Database through governed interfaces: Model Context Protocol basics, the managed Autonomous AI Database MCP Server, tool design and least-privilege access controls.

Exam weight estimate
Not published
Official topics estimate
4
Estimated questions estimate
~6
Suggested study time estimate
8–10 hrs

About 11 min read Reviewed October 2026

Overview

Domain 5 is about how agents outside the database reach it safely. The main subject is the Autonomous AI Database MCP Server, a built-in, managed implementation of the Model Context Protocol. Once enabled on a database, it lets MCP clients such as AI assistants, IDE agents or custom applications discover and call tools over HTTPS.

Tools are defined in the database, typically with DBMS_CLOUD_AI_AGENT, so a SQL query, RAG lookup or PL/SQL procedure becomes a callable capability without writing a separate server. You should also know the SQLcl MCP server for local development, how MCP clients authenticate as database users, and how the database's own privileges, Virtual Private Database policies and auditing limit what any agent can do. The theme is giving agents access through governed interfaces rather than open database connections.

How it's tested

Expect architecture scenarios. An organisation wants an external AI assistant to use database data, and you choose the interface, the authentication approach or the way to limit what the assistant can call. Some questions check MCP vocabulary: client, server, tool, and how discovery works.

  • Choose the interface

    A team needs agents to reach database capabilities, and you pick the ADB MCP Server, SQLcl MCP server, a REST endpoint or a direct connection.

  • Limit the blast radius

    A security requirement is described, and you choose least-privilege users, narrow tool definitions, VPD policies or auditing.

  • Name the MCP role

    A component is described, and you identify it as an MCP client, an MCP server or a tool the server advertises.

Reasoning it through

A company wants a desktop AI assistant to answer questions from its Autonomous AI Database, but security forbids handing out schema passwords with broad rights. Enabling the ADB MCP Server and registering a few narrowly scoped tools lets the assistant discover and call only those capabilities, authenticating as a restricted database user. A direct SQL*Net connection would expose far more than the use case needs.

Topics 4

Official topics from the Oracle outline, in outline order.

5.1 Explain the Model Context Protocol for database agentsMCP clients, servers, tools and discovery.
What it means
The Model Context Protocol is an open standard for connecting AI applications to tools and data. An MCP client, usually inside an AI assistant or agent framework, connects to an MCP server, lists the tools it advertises with their descriptions and input schemas, and calls them with arguments the model chooses.
What to understand
MCP standardises the connection so any compliant assistant can use the same tools without custom glue code. The server decides which tools exist, so the server side is where you control scope. Tool descriptions are read by the model, which means clear names and descriptions directly affect how reliably an agent picks the right tool.
How it shows up
Questions ask which component advertises tools, or why an agent never calls a tool that exists on the server.
Common confusion
Thinking the MCP client defines the tools; the server advertises them and the client discovers them.
5.2 Enable and use the Autonomous AI Database MCP ServerManaged MCP endpoint built into Autonomous AI Database.
What it means
Autonomous AI Database includes a managed MCP server that is turned on per database, after which it serves an HTTPS endpoint tied to that database. MCP clients connect to the endpoint, authenticate, and see the tools registered in the database, typically defined with DBMS_CLOUD_AI_AGENT.CREATE_TOOL.
What to understand
Because the server is managed, there is nothing to deploy or patch, and tools run inside the database with its security. Exposing Select AI, RAG or custom PL/SQL as MCP tools lets external agents reuse logic you already built. The SQLcl MCP server is the local alternative, running from a developer machine against any reachable database.
How it shows up
A scenario asks how to let a hosted assistant use database tools with no extra infrastructure.
Common confusion
Assuming you must build and host your own MCP server for Autonomous AI Database.
5.3 Expose database capabilities as agent toolsDefining SQL, RAG and PL/SQL tools for external agents.
What it means
Tools turn database logic into callable actions. A SQL tool runs natural-language queries through a Select AI profile, a RAG tool retrieves from a vector index, and a custom PL/SQL tool wraps a function or procedure with defined parameters. The same definitions serve Select AI Agent teams and MCP clients.
What to understand
Good tool design follows the principle of doing one thing with clear inputs. Narrow tools are safer and easier for models to choose correctly than one generic run-any-SQL tool. Parameter names and descriptions should state units and formats so the model passes valid arguments.
How it shows up
Expect a choice between a broad SQL execution tool and several focused tools, with the safer design as the answer.
Common confusion
Believing a single unrestricted SQL tool is simpler and therefore preferred; it widens risk and confuses tool choice.
5.4 Secure agent access to database dataLeast privilege, authentication, VPD, auditing and data boundaries.
What it means
Agent access should use dedicated database users with only the privileges their tools need. Oracle features such as Virtual Private Database policies, Real Application Security, data redaction and unified auditing continue to apply when an agent calls a tool, because the tool runs as a database session.
What to understand
The database, not the LLM, enforces security. Prompt instructions telling a model not to view pay data are not a control; row and column policies are. Auditing tool calls supports investigations, and credentials for outbound providers should live in database credential objects rather than in tool code.
How it shows up
A requirement to keep certain rows or columns from an agent maps to database policies, not prompt wording.
Common confusion
Relying on system prompts to block sensitive data instead of database privileges and policies.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Model Context Protocol

    Open standard linking AI clients to tool servers.

    Remember
    Clients discover tools the server advertises.
    Tested as
    Vocabulary and architecture questions.
    Trap
    Mixing up client and server roles.

  • MCP tool

    A named capability with description and input schema.

    Remember
    Descriptions guide the model's choice.
    Tested as
    Tool design questions.
    Trap
    Vague descriptions.

  • ADB MCP Server

    Managed MCP endpoint built into Autonomous AI Database.

    Remember
    Enabled per database; nothing to host.
    Tested as
    Production integration scenarios.
    Trap
    Deploying a custom server instead.

  • SQLcl MCP server

    MCP server started from SQLcl on a local machine.

    Remember
    Suits development and on-premises use.
    Tested as
    Interface choice questions.
    Trap
    Using it as a managed production endpoint.

  • Tool registration

    Defining tools in the database, often with DBMS_CLOUD_AI_AGENT.CREATE_TOOL.

    Remember
    Same tools serve agents and MCP clients.
    Tested as
    Reuse questions.
    Trap
    Duplicating logic outside the database.

  • Least-privilege agent user

    A database user with only the rights its tools require.

    Remember
    Limits damage from a misled agent.
    Tested as
    Security scenarios.
    Trap
    Reusing an admin account.

  • Virtual Private Database

    Row-level policies enforced on every query.

    Remember
    Applies to agent sessions too.
    Tested as
    Data restriction scenarios.
    Trap
    Relying on prompt instructions.

  • Unified auditing

    Records database actions including tool-driven queries.

    Remember
    Supports investigation of agent behaviour.
    Tested as
    Compliance questions.
    Trap
    Assuming agent calls are invisible.

  • Narrow vs. generic tools

    Focused tools versus one run-any-SQL tool.

    Remember
    Narrow tools are safer and easier to choose.
    Tested as
    Design trade-off questions.
    Trap
    Preferring one broad tool.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Ways for agents to reach the database

ConceptMeaningKey differenceCommon trap
ADB MCP Server Managed MCP endpoint on Autonomous AI Database No infrastructure; tools governed in database Thinking it must be self-hosted
SQLcl MCP server Local MCP server launched from SQLcl Developer and on-premises use Treating it as a managed service
Direct database connection Agent framework connects with a driver Broadest access, most custom code Granting wide privileges for convenience

Controls for agent data access

ConceptMeaningKey differenceCommon trap
Database privileges Grants on objects and procedures Hard boundary enforced by the database Using shared admin users
VPD and redaction Row and column level policies Applied to every session automatically Forgetting they cover agents too
Prompt instructions Text telling the model what to avoid Guidance only, not enforcement Treating them as a security control

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Client defines tools

    What candidates pick
    Configure the assistant to declare what the database can do.
    Why it looks right
    The client is where the user works.
    Why it's wrong
    The MCP server advertises tools and their schemas; clients only discover and call what the server exposes.

    Clue to watch for The question asks where tool scope is controlled.

  2. Prompts are security

    What candidates pick
    Add a system prompt forbidding access to payroll columns.
    Why it looks right
    Models usually follow instructions.
    Why it's wrong
    Prompt text can be ignored or bypassed; database privileges, VPD and redaction actually prevent access.

    Clue to watch for A hard compliance requirement is stated.

  3. One tool for everything

    What candidates pick
    Expose a single tool that runs any SQL the model writes.
    Why it looks right
    Fewer tools look simpler.
    Why it's wrong
    A generic SQL tool widens risk and gives the model less guidance than several focused, well-described tools.

    Clue to watch for Security or reliability concerns appear in the scenario.

  4. Self-host the MCP server

    What candidates pick
    Deploy a container to provide MCP for Autonomous AI Database.
    Why it looks right
    Many MCP servers are self-hosted.
    Why it's wrong
    Autonomous AI Database has a built-in managed MCP server, so an extra deployment adds work without benefit.

    Clue to watch for The database is Autonomous AI Database and minimal infrastructure is wanted.

  5. Admin user for convenience

    What candidates pick
    Let the MCP client sign in as ADMIN to avoid grant errors.
    Why it looks right
    It removes permission failures quickly.
    Why it's wrong
    Agents should run as least-privilege users so a misled model cannot change or read data outside its purpose.

    Clue to watch for The scenario mentions external or third-party assistants.

Answer framework

Work through agent access questions in this order to pick the governed interface.

  1. Identify who is calling: an in-database Select AI Agent team, an external MCP client, or a developer tool on a laptop.
  2. Choose the interface: ADB MCP Server for managed external access, SQLcl MCP server for local work, direct connections only when justified, because each one changes who manages credentials and network exposure.
  3. Define narrow tools with clear names, descriptions and parameter schemas rather than one open SQL tool.
  4. Bind tools to a least-privilege database user and apply VPD, redaction or Real Application Security for sensitive data, so the agent can never see more data than the person it acts for.
  5. Turn on auditing and review tool call history so agent actions can be traced and refined over time.

Practice question

A sales team wants a third-party AI assistant to look up open orders in Autonomous AI Database. Security requires minimal infrastructure and no broad database credentials. Which approach fits best?

Want more like this? The 1Z0-1159-26 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with the MCP vocabulary, because many questions hinge on who advertises tools and who calls them. Read the MCP overview and sketch a client, server and three tools on one page.

Then work hands-on with Autonomous AI Database. Enable the built-in MCP Server by following the Oracle documentation, register two or three tools with DBMS_CLOUD_AI_AGENT, and connect an MCP-capable assistant or IDE agent to the endpoint. Watch which tool it picks for different prompts and rewrite one description to see the choice change. If you also work on-premises, start the SQLcl MCP server locally and compare setup effort.

Next, create a dedicated agent user with grants only on the objects its tools use. Add a simple VPD policy and confirm the agent cannot see restricted rows even when asked directly. Enable unified auditing for that user and read the trail. Close with scenario questions that ask for the safest interface, and practise eliminating any option that hands out broad credentials or treats prompt text as a control. Keep a short list of the security features that still apply to tool-driven sessions and review it before the exam.

FAQ

How much of 1Z0-1159-26 is Domain 5, Configure Agentic Interfaces and Tool Access?

Oracle publishes no weights. This interfaces and tool access section looks smaller than the vector and RAG sections in third-party material, but it carries security scenarios that are easy to miss.

What is the ADB MCP Server?

A managed Model Context Protocol server built into Autonomous AI Database. When enabled, MCP clients can discover and call tools defined in that database over HTTPS.

How is it different from the SQLcl MCP server?

The SQLcl MCP server runs locally from SQLcl and suits development or on-premises databases. The ADB MCP Server is managed by Oracle and tied to an Autonomous AI Database.

Where are MCP tools defined?

In the database, typically with DBMS_CLOUD_AI_AGENT.CREATE_TOOL, so the same tools serve Select AI Agent teams and external MCP clients.

How do I stop an agent from seeing sensitive rows?

Use database controls: a least-privilege user, Virtual Private Database policies, redaction or Real Application Security. Prompt instructions are not enforcement.

Why prefer several narrow tools over one SQL tool?

Narrow tools limit what an agent can do and give the model clearer choices, which improves both safety and reliability.

Other Artificial Intelligence & Machine Learning certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered MCP basics, the ADB MCP Server, tool design and least-privilege agent access. Test whether you can pick the governed interface in a scenario.

Take the 1Z0-1159-26 practice test Check your 1Z0-1159-26 readiness

Keep going