SSOGEN / Learn / AI Agent Oracle EBS Access: Letting Agents In Without a Password
Learn
AI Agent Oracle EBS Access: Letting Agents In Without a Password
For AI agent Oracle EBS access, the safe pattern gives the agent no EBS password at all: it proves who it is with its own key, runs under the same policy as your staff, and asks a person before any risky action.
Updated
The short answer. Give an AI agent access to Oracle EBS through a checkpoint (a gateway that checks every tool call), not an EBS user name. The agent holds a key, a token that lasts minutes, and a list of tools it may call.
The decision for the ERP owner. Four controls decide whether an agent is safe in EBS: no stored password, the same policy as people, a person’s approval for risky actions, and an audit record that names the agent.
Why an EBS password in an agent is the wrong start
An agent that calls Oracle E-Business Suite (EBS) directly needs an EBS credential, and EBS REST services accept only two kinds. The Integrated SOA Gateway Implementation Guide (Release 12.2) describes both, and both are enabled by default.
- HTTP Basic. The caller sends an EBS user name and password with each request. EBS checks them against its own user table.
- Security token. The caller signs in once with a user name and password. The Login service returns an EBS session ID, which later requests send as a cookie.
Either way, the agent stores a password or a live session, and EBS records the work under that EBS user. Grants to REST methods go to users or groups of users, so the agent inherits whatever that user can do.
Three ways an agent can reach EBS
The patterns below differ in what the agent holds and what an auditor sees afterwards.
| Pattern | What the agent holds | What the record shows |
|---|---|---|
| Agent signs in as an EBS user | A saved EBS password or session ID | That EBS user; the agent is invisible |
| Agent borrows a person’s account | The person’s password | The person, for every action the agent takes |
| Agent calls tools through a checkpoint | Its own key and a token that lasts minutes | The agent, the person it works for, the tool and the decision |
Only the third pattern keeps the EBS credential out of the agent. An MCP server that you or a vendor run holds its own EBS service account and accepts calls only from the checkpoint. The MCP authorization specification forbids passing the agent’s token on to EBS. The Oracle MCP server options page compares the servers Oracle documents.
The same policy as people
An agent should meet the rules your staff meet, translated for software. The table maps each control people already have, such as EBS responsibilities, to its agent equivalent.
| For people | For an agent | Why it matters in EBS |
|---|---|---|
| Sign-in policy and second factor | The person passes sign-in policy first | No agent acts for someone outside your rules |
| Roles | Scopes naming the exact tools | An invoice reader cannot approve invoices |
| Password expiry | A key-bound token, valid minutes | A copied token is useless to others |
| Leaver process | A remaining owner takes over, or the agent is suspended | No orphaned agent works in finance |
| Disable a user | Suspend one agent or one type | One action; people keep working |
Delegation never widens access. When an agent acts for Maria Lopez, it gets at most what she approved and what she can reach herself.
Approval from a phone for risky actions
A risky action, such as approving an invoice for payment, should wait for a human yes at the moment it happens. OpenID Client-Initiated Backchannel Authentication (CIBA) is the standard for this: the agent asks in the background, and the person decides on another device, often a smartphone.
Here is the flow for an accounts payable agent at Acme Corp:
- The agent asks to approve an invoice through a tool at
ebs-mcp.acme.example. - The approval scope is marked sensitive, so the agent holds no standing right to it. It sends an approval request with a short message.
- Maria Lopez sees the request on her Approvals page, which opens in a phone browser. She may be asked for her second step first.
- She approves or denies. If she does nothing, the request expires and the agent is refused.
- On approval, the agent receives a single token for that scope that lasts minutes, and the decision is recorded.
An approval opens a short window for one scope, not one specific invoice. Set amount and record limits in the MCP server and in its EBS account as well.
What the audit record must answer
The record must name who acted, for whom, and on what decision. A shared EBS user answers none of these.
- Who. The agent, by its own identifier, with its owners.
- For whom. The person, when the agent acted for someone.
- What. The application, the scope and the tool name.
- Decision. Allowed or refused, including refused calls and approvals.
Token issues, delegations, approvals and kill-switch changes belong in the same trail. No entry should hold a token, a key or the agent’s message text.
A checklist before an agent touches EBS
Ask these six questions before you approve any agent project.
- Does the agent hold an EBS password or session ID anywhere? The answer should be no.
- Which EBS account does the MCP server use, and who limits its responsibilities?
- Can you list every tool the agent may call, and does the checkpoint refuse the rest?
- Which tools move money or change master data? Each needs a person’s approval at every use.
- Who owns the agent, and what single action stops it?
- Will the record name the agent and the person, not only the EBS user?
How SSOGEN gives agents EBS access without a password
SSOGEN registers each AI agent as its own identity and checks every tool call before it reaches your EBS MCP server.
- No password. The agent proves itself with a key pair. SSOGEN refuses a registration that holds a private key.
- Owners and expiry. One to five named people own each agent, with an expiry or review date at most 365 days ahead.
- Short tokens. Tokens are bound to the agent’s key and last about four minutes.
- Tool checks. The MCP Gateway allows only tools named in the agent’s granted scopes. Any other tool gets a 403.
- Approvals. Sensitive scopes need the person’s approval at every use, on the page described in what people see and approve.
- No token forwarding. Your MCP server receives verified identity headers naming the agent and the person, never the token.
- Stop it. Suspend one agent, revoke one delegation, or engage a kill switch for a whole type.
The setup steps are in MCP server authorization for Oracle EBS agents. The registration model is on AI agent identity.
Questions people ask
Can an AI agent access Oracle EBS without a password?
Yes. The agent calls tools on an MCP server through a checkpoint that verifies the agent’s own key and token. The MCP server holds its own EBS service account and accepts calls only from the checkpoint. The agent never sees an EBS user name, password or session ID, so none can leak from it.
How do EBS REST services authenticate a caller?
Oracle’s Integrated SOA Gateway Implementation Guide lists HTTP Basic authentication, with an EBS user name and password, and security token authentication, with an EBS session ID returned by the Login service. Both are selected by default when a REST service is deployed. Each one ties the caller to a single EBS user.
Can an AI agent approve invoices in Oracle EBS?
It can if you allow it, but approval should be a sensitive scope. The agent then asks the person it works for each time, and the person approves or denies it on a phone or desktop. Keep amount limits in the MCP server and its EBS account, because approval opens a short window, not one invoice.
Where is a tutorial for connecting an AI agent to Oracle EBS?
The step-by-step setup has four parts. Publish your EBS MCP server through the Gateway, map scopes to tool names, register the agent with owners and a key, and test access before any agent code runs. Revoking access and reading the audit entries follow the same path.
Where to go next
- Delegation records. AI agent delegation audit covers proof of who approved each action.
- Leavers. Offboarding AI agents explains what happens to agents when their owner leaves.
- Bots in EBS. RPA service accounts in EBS audits covers robots on human accounts.
- More explainers. The Learn hub lists related pages.
Sources, all read 2026-11-14:
- Oracle E-Business Suite Integrated SOA Gateway Implementation Guide, Release 12.2 (Part No. E20925-23, October 2025): REST service security, HTTP Basic and token-based authentication, and grants (Oracle).
- OpenID Connect Client-Initiated Backchannel Authentication Flow, Core 1.0, final, September 1, 2021 (OpenID Foundation).
- Model Context Protocol specification, Authorization, revision 2026-07-28: audience validation and the ban on token passthrough.
Oracle and Oracle E-Business Suite are trademarks of Oracle and its affiliates. SSOGEN is an Oracle partner, but Oracle has not reviewed or endorsed this page.