Getting Access to Generative AI Agents

Give users access to Generative AI Agents resources such as agents, knowledge bases, data sources, data ingestion jobs, agent sessions, agent work requests, and endpoints

• To get access to all Generative AI Agents resources in the entire tenancy, use the following policy:
  Copy

  allow group <genai-agent-administrators> to manage genai-agent-family in tenancy

• To get access to all Generative AI Agents resources in your compartment, use the following policy:
  Copy

  allow group <genai-agent-administrators> to manage genai-agent-family in compartment <your-compartment-name>

If the data files for your agent are in OCI Object Storage buckets, you need permission to list and select those files from within the Generative AI Agents service.

• To give permission to users to add Object Storage files to their knowledge bases:
  Copy

  allow group <your-group-name> to manage object-family in compartment <compartment-with-bucket>

Ask an administrator to review the examples in Securing Object Storage and add policies that apply to you such as policies to avoid accidental deleting of buckets that contain training data.

To ingest large amounts of content from OCI Object Storage, follow these steps to create resource principals for data ingestion jobs that might run longer than 24 hours.

1. Follow the steps in Creating a Dynamic Group with the following specifics for the matching rule:
   1. In the Matching Rules section, click Match any rules defined below.
   2. Enter the following matching rule.
      Copy

      ALL {resource.type='genaiagentdataingestionjob'}

      The genaiagentdataingestionjob resource type is the resource principal for data ingestion jobs. The preceding matching rule means that this dynamic group represents the Generative AI Agents data ingestion job resource.

      To restrict the dynamic group membership to data ingestion jobs created in a specific compartment, instead of the previous matching rule, use the following one:

      Copy

      ALL {resource.type = 'genaiagentdataingestionjob', 
      resource.compartment.id = '<compartment-ocid-for-ingestion-jobs>’}
      

   3. Allow this dynamic group to access Object Storage objects in a specified compartment.
      Copy

      allow dynamic-group <dynamic-group-name> 
      to read objects in compartment <compartment-name-for-objects>
      

      You can further restrict the policies with more conditions. For example:

      Copy

      allow dynamic-group <dynamic-group-name> 
      to read objects in tenancy where all {target.compartment.id='<compartment_ocid>’, 
      target.bucket.name=<bucket-name>, 
      target.bucket.tag.MyTagNamespace.TagKey='<MyTagValue>'}
      

      See Securing Object Storage for more examples on writing policies.

      Note
      
      You can restrict access to Object Storage, using conditions that include bucket names, compartments, and tags. Restricting access by specifying an object name or prefix in a policy, such as target.object.name isn't supported and the data ingestion job might fail.

If your data is in Oracle Database vector store or OCI Search with OpenSearch, perform the following tasks:

1. For Oracle Database data, perform the tasks in RAG Tool Oracle Database Guidelines for Generative AI Agents.
2. For OCI Search with OpenSearch data, perform the tasks in RAG Tool OCI Search with OpenSearch Guidelines for Generative AI Agents.
3. Follow the steps in Creating a Dynamic Group with the following specifics for the matching rule:
   1. In the Matching Rules section, click Match any rules defined below.
   2. Enter the following matching rule.
      Copy

      ALL {resource.type='genaiagent'}

      The genaiagent resource type is the resource principal for agents. The preceding matching rule means that this dynamic group represents the Generative AI Agents agent resource.

   3. Allow this dynamic group to access OCI Vault secrets in the compartment with your Oracle Database vector store or OCI Search with OpenSearch secret.
      Copy

      allow dynamic-group <dynamic-group-name> 
      to read secret-bundle in compartment <compartment-name>
      

If your data is in Oracle Database 23ai, update the dynamic group that you created in the previous section and add another rule to allow this dynamic group to access OCI Database Tools.

allow dynamic-group <dynamic-group-name> 
to read database-tools-family in compartment <compartment-name>

allow group GenAI-agents-users to use genai-agent in compartment GenAI-agents-compartment

allow group GenAI-agents-users to manage genai-agent-knowledge-base in compartment GenAI-agents-compartment

allow group GenAI-agents-users to inspect genai-agent-data-source in compartment GenAI-agents-compartment

allow group GenAI-agents-users to inspect genai-agent-data-ingestion-job in compartment GenAI-agents-compartment

allow group GenAI-agents-users to manage genai-agent-endpoint in compartment GenAI-agents-compartment

allow group GenAI-agents-users to read genai-agent-work-request in compartment GenAI-agents-compartment

allow group GenAI-agents-users to manage genai-agent-session in compartment GenAI-agents-compartment