# Oracle Database > Oracle Database: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the Oracle Database tables and views you name, in place, through a read-only database user in the client’s own network, so agents can answer from a register or a ledger without it being copied to a vendor. Every statement it sends is a SELECT. ## At a glance | Collector | Oracle Database, version `1.0.0` | | --------------------------- | --------------------------------------------------------------------------------------------------------- | | Reads | Oracle: Oracle Database ([the vendor's documentation](https://python-oracledb.readthedocs.io/en/latest/)) | | Family | Data | | Kind | Database | | Ways to connect | Access token | | Scopes | - Read: `CREATE SESSION`, `SELECT on the named tables and views` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Content, Contact, Identity, Financial, Employment | | Hosts it may contact | Only the hosts on your deployment's allow-list (`*`: the host is the one you give it) | | Vendor API versions | python-oracledb 2.x and 3.x, thin mode (Oracle Net, TNS); SQL SELECT only | | Lowest engine version | `0.46.0` | ## What it reads - The tables and views you name (`SCHEMA.NAME`), with the key column, optionally an `updated` column, a `title` column and the `columns` to read (every column otherwise). A whole database is never the default. - With an `updated` column, a pull reads rows later than the cursor less `margin_minutes` (five by default: a row committed by a long transaction carries a time from before it became visible), ordered by it. Without one, the table is read whole on every pull and an unchanged row costs nothing to rewrite; say so to the client before naming a large table. - Deletions: every six hours the keys are listed (`SELECT ` only) and a row that has gone is withdrawn. A table the user can no longer see (ORA-00942, ORA-01031) keeps its rows until it can be listed again. A table taken out of the configuration has its rows withdrawn. - A LOB is read as text up to `max_chars` (100,000) and then marked truncated; a binary value is named by its size and never written to the corpus. ## How to connect 1. In the database, create a user that holds `CREATE SESSION` and `SELECT` on the named tables and views, and nothing else. 2. In LightHouse, open **Connectors**, choose **Oracle Database**, and give the three lines of the credential: the connect string (`host:port/service_name`), the user and its password. They are sealed in your browser to your deployment’s key and kept in your own secrets store; LightHouse never opens them. The deployment must be able to reach the database. 3. In code, set `ORACLE_DB_CREDENTIAL` to the credential’s JSON fields (`dsn`, `user`, `password`) and add a `kind: oracle-db` source card with `tables`, `label` and `requires`. Install the engine’s `oracle` extra (python-oracledb, thin mode: pure Python, no Oracle Instant Client). ## Permissions `CREATE SESSION` and `SELECT` on the named objects, and nothing else; read and write is not offered. The health check connects and lists the session’s privileges, so LightHouse can mark a connection failing whose user could change the database (any DML, DDL or administration privilege). This collector speaks Oracle Net through a database driver, not HTTP, so its read-only test is written its own honest way: it runs the real connect path against a fake `oracledb` driver that records every statement sent, over a first pull, a reconciling pull, the privilege listing and the health check, and asserts that every statement is a SELECT (or the `SET TRANSACTION READ ONLY` that opens each session) and that no write verb appears. In the code, every statement goes through one function that refuses anything but a SELECT, so even a bug cannot write; the database refuses DML in a read-only transaction, and the user’s grants refuse it again. ## Limits - Every identifier (schema, table, column) is checked against Oracle’s unquoted-identifier shape, upper-cased and quoted; a value is only ever a bind variable. A table named `X; DROP TABLE Y` is refused before a connection is opened. - A table is `SCHEMA.NAME`, named once; a row with a null key is skipped. - Pages are 50 to 5,000 rows (500 by default). - The `margin_minutes` margin means a row is read again a little after it is first seen; the contract writer makes an unchanged row free. - The hosts it contacts are the one in the connect string, inside the client’s network. ## Data handling - The columns you name are copied into the deployment’s corpus under the source’s `label`; whatever the tables hold (names, contact details, financial or employment records) is copied, so name the columns, not the table, where a table holds more than the question needs. - The credential is held in the client’s own store; the password is never written to logs, run notes or the corpus, and an error reports an ORA- code, never a message. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | ---------------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------- | | `name the tables to sync; a whole database is never the default` | `tables` is empty | Name the tables | | `not an Oracle identifier` | A schema, table or column name is not a plain Oracle identifier | Use the plain name; no quotes, spaces or punctuation | | `table is SCHEMA.NAME` | A table was named without its schema | Write `SCHEMA.NAME` | | `a table is named twice` | The same table appears twice | Remove the duplicate | | `only SELECT is ever run against a client's database` | A statement that is not a read was about to be sent | Report it; nothing was sent | | `Oracle Database needs the engine's `oracle` extra` | python-oracledb is not installed | Install `aal-engine[oracle]` | | `ORA-01017`, `ORA-28000` or `ORA-01045` | The user or password is wrong, the account is locked, or it lacks CREATE SESSION | Fix the user | | `ORA-00942` or `ORA-01031` when listing | The user cannot see the table | Grant `SELECT`; rows are kept meanwhile | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | -------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | python-oracledb 2.x and 3.x, thin mode | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/oracle-db/