Episode Details

Connor McDonald is back.

Oracle Developer Advocate, long-time face of Ask TOM, international speaker – and someone who has probably visited more Oracle User Groups than most of us have visited airports.

His next trip to India alone will be his 26th visit.

In this episode, we catch up on what has happened since our last conversation and quickly find ourselves talking about APEX 26, AI and an increasingly important question:

How do we secure our development environments when humans are no longer the only ones working inside them?

Topics in this episode:

• What Connor has been up to since his last Devs On Tape appearance • APEX 26 and Oracle Database 26 • Ask TOM Office Hours and travelling through the Oracle community • Connor’s 26th trip to India • Why live demos at conferences are becoming increasingly risky • Cloud dependencies, Wi-Fi and AI providers as additional points of failure • Why Connor increasingly uses local LLMs for demos • LM Studio and running AI models locally • The limitations of smaller local models • APEX Lang with local and cloud-based LLMs • Skills and specialised knowledge for LLMs • Tools, MCP and Skills • Oracle Skills and community contributions • Why AI-generated knowledge doesn’t automatically replace human experience • What happens when junior developers can suddenly appear “senior” with AI • Deep Data Security in Oracle Database 26 • Row- and column-level security in a world of AI agents • What happens when an AI agent operates with a developer’s privileges • The risks of schema owner credentials in development environments • Why existing development practices can become significantly more dangerous with AI • Security as a responsibility for the entire IT community • Citizen developers and easier access to AI capabilities • Why the AI Assistant in Interactive Reports is one of Connor’s favourite APEX 26 features • Guardrails instead of unrestricted database access • Why Connor is more cautious about “Talk to your Data” approaches

One idea becomes particularly important in the second half of the conversation:

AI doesn’t automatically make things dangerous. But AI can exploit existing bad security practices much faster.

If we give a developer the schema owner password in a development environment and then introduce an agent that acts on behalf of that developer, we haven’t created a completely new problem.

We’ve automated an existing one.

That’s why Connor sees Deep Data Security as an important step towards a more granular security model – one that can control which rows and columns are accessible under specific conditions instead of simply asking whether someone has access to a table.

And then there’s Connor’s personal favourite from APEX 26:

AI in Interactive Reports.

Not necessarily APEX Lang.

Why?

Because natural language doesn’t simply get unrestricted access to the database. Instead, the request is translated into the existing Interactive Report filtering mechanisms.

AI with guardrails built in.

And perhaps that is the more interesting direction.

Not:

“What can we allow AI to do?”

But:

“How can we give AI new capabilities without bypassing the security mechanisms we already have?”