Oracle AI Database Deep Data Security in Node.js Applications

With the latest node-oracledb 7.0 release, you can harness secure, database-native access control for Node.js applications with minimal code changes using Oracle AI Database 26ai’s latest Deep Data Security feature.

Oracle Database security has traditionally focused on protecting data at rest, in transit, and through fine-grained access controls. With the introduction of **Oracle Deep Data Security support in node-oracledb 7.0**, JavaScript and TypeScript developers can now take advantage of advanced database-native data protection capabilities while continuing to use familiar SQL and application patterns with AI agentic applications.

Key Takeaways

• Agentic AI performs complex tasks, but introduces new security risks, such as prompt injection and misuse of privileged database access, making traditional controls insufficient.
• Oracle AI Database 26ai’s latest Deep Data Security feature enforces fine-grained, end-user access directly in the database, improving security, auditability, and scalability.
• **Node-oracledb 7.0 provides new APIs to integrate Oracle Deep Data Security seamlessly, which enables passing end-user security context into Oracle Database connections **from Node.js applications.
• Shifting access control from the application to the database simplifies architecture, reduces security vulnerabilities, and supports evolving roles without extensive code rewrites.

Oracle AI Database 26ai recently introduced Oracle Deep Data Security, a next-generation data access control system to protect sensitive data in the new era of AI agents and AI powered applications.

JavaScript and Node.js are widely used for building modern web applications, APIs, microservices, and AI-enabled services. Their scalability, rich ecosystem, and integration with AI frameworks make them a popular choice for enterprise applications that require secure access to business-critical data.

In enterprise environments, applications often use connection pooling and shared database accounts for scalability, making it challenging to enforce data access policies based on the actual application user. The node-oracledb driver provides secure, high-performance connectivity between Node.js applications and Oracle Database, enabling scalable applications while leveraging advanced Oracle Database capabilities.

Node-oracledb 7.0 adds support for Oracle Deep Data Security through APIs that allow applications to set and manage end-user security context on database connections. This enables Deep Data Security policies to evaluate access using the identity and attributes of the actual application user, even when requests are processed through pooled database sessions. As a result, Node.js applications can seamlessly integrate with Oracle Deep Data Security while continuing to use standard SQL and existing connection pooling architectures.

What is Oracle Deep Data Security?

As organizations move agentic AI into production, maintaining safe and auditable access to enterprise data becomes critical. Excessive agency, prompt injection, and other security risks can allow guardrails to be bypassed, run malicious SQL and expose confidential and privacy related data a user is not authorized to access. Oracle Deep Data Security helps address these challenges.

Oracle Deep Data Security is a database-native authorization system designed to give developers and security teams the necessary controls to manage end-user and agent access across agentic, analytics, and enterprise application workloads.

Oracle Deep Data Security Overview

Built into Oracle AI Database 26ai, it applies controls on data based on user identity and runtime context. With declarative SQL policies, developers can enforce row, column, and cell-level control limiting end users to authorized data — even if the application or agentic AI layer gets subverted or makes a mistake.

Refer to the Oracle Deep Data Security documentation for more details.

So, What does Oracle Deep Data Security offer?

Oracle Deep Data Security is designed to manage data access at the effective end-user level while keeping enforcement in the database layer. Key capabilities include:

• Identity and context aware access control integrated into the database
• Fine-grained, database-enforced authorization managed at the database user level
• Declarative, SQL-native policies for evolving workloads
• Token-based identity integration using Microsoft Entra ID (formerly Microsoft Azure AD) and OCI (Oracle Cloud Infrastructure) IAM tokens
• Support for both Client Credentials and On-Behalf-Of (OBO) token flows

How does node-oracledb enable Oracle Deep Data Security?

Node-oracledb 7.0 introduces APIs and a End User Security Context object that enable applications to manage End User Security Context information.

The new capability enables node-oracledb to interact with Oracle AI Database Deep Data Security functionality and allow applications to associate security metadata with a database connection.

So, node-oracledb 7.0 has the following new object and APIs for enabling Node.js applications to use Oracle Database Deep Data Security:

• *EndUserSecurityContext object*
• *connection.setEndUserSecurityContext*
• *connection.clearEndUserSecurityContext*

The application is responsible for:

• Authenticating users (using oracledb.EndUserSecurityContext object)
• Determining user attributes
• Setting security context (call connection.setEndUserSecurityContext())
• Clearing context after use (call connection.clearEndUserSecurityContext())

Oracle Deep Data Security handles:

• Policy evaluation
• Data filtering and masking
• Access control decisions

Let us run through a sample usage of node-oracledb’s Deep Data Security capability

Middle-tier apps often connect to the database as one application user, so the database does not know which end user is making the request. This prevents the database for identifying the right set of data to be exposed to the user.

Oracle Deep Data Security solves this problem by identifying the user information using a secure identity provider authentication mechanism (e.g., OCI IAM or Microsoft Entra ID OAuth tokens).

The following architectural workflow of a sample agentic AI app demonstrates the use of Oracle Deep Data Security feature via a Node.js middle tier using Microsoft Azure Entra ID tokens:

Demo App Architectural Workflow

Note the database must already be configured with the Deep Data Security settings for the all the relevant roles. Check out the Oracle Deep Data Security documentation to see how to configure Oracle Deep Data Security on Oracle Database for these roles.

Here is a sample code snippet from a Node.js middle-tier application (from the architectural workflow above) that implements Oracle Deep Data Security support:

const oracledb = require('oracledb');
//...
const { ConfidentialClientApplication } = require('@azure/msal-node');
const { ProxyAgent } = require('undici');
// ...

// msal uses undici internally when we inject a custom network client.
// Reuse the same proxy endpoint via ProxyAgent so
// ConfidentialClientApplication traffic follows the proxy.
const dispatcher = new ProxyAgent('<proxy_url>');

// build the MSAL object to get the token
function buildMsalApp(params) {
  return new ConfidentialClientApplication({
    auth: {
      clientId: params.client_id,
      clientSecret: params.client_credential,
      authority: params.authority,
    },
    system: {
      networkClient: {
        async sendGetRequestAsync(url, options) {
          const res = await fetch(url, {
            method: 'GET',
            headers: options?.headers,
            // undici's dispatcher ensures msal calls also traverse the proxy.
            dispatcher,
          });

          const text = await res.text();
          return {
            status: res.status,
            headers: Object.fromEntries(res.headers),
            body: text ? JSON.parse(text) : {},
          };
        },

        async sendPostRequestAsync(url, options) {
          const res = await fetch(url, {
            method: 'POST',
            headers: options?.headers,
            body: options?.body,
            // Same proxy path for POST requests from msal
            dispatcher,
          });

          const text = await res.text();
          return {
            status: res.status,
            headers: Object.fromEntries(res.headers),
            body: text ? JSON.parse(text) : {},
          };
        },
      },
    },
  });
}

// get the database access token
async function getAppIdToken() {
  const msalApp = buildMsalApp({
    client_id: '<AZURE_CLIENT_ID>',
    client_credential: '<AZURE_CLIENT_CREDENTIAL>',
    authority: '<AZURE_TOKEN_URL>',
  });

  const result = await msalApp.acquireTokenByClientCredential({
    scopes: '<AZURE_SCOPE>',
  });
  return result.accessToken;
}
// ...
const databaseAccessToken =  await getAppIdToken();
const securityContext = new oracledb.EndUserSecurityContext({
  endUserToken,
  databaseAccessToken,
});

try {
  // Connection must use TCPS for End User Security Context
  const connection = await oracledb.getConnection({
    user: '<db_user>',
    password: '<db_password>',
    connectString: '<tcps_connect_string>',
    walletLocation: '<wallet_location>',
    walletPassword: '<wallet_password>',
  });
  connection.setEndUserSecurityContext(securityContext);

  // node-oracledb sends the end user security context on
  // the database connection during round trips.
  const result = await connection.execute(`
    SELECT * FROM hr.employees
  `);

  console.log('Rows returned:', result.rows);
} finally {
  try {
    connection.clearEndUserSecurityContext();
  } finally {
    await connection.close();
  }
}

This application initializes the end user security context with the database access token obtained from Microsoft Azure Entra ID.

Now, let us consider that this application accesses HCM data for managers and employees of a particular company. The database is now configured with separate Deep Data security settings for managers and their employees.

Here are some outputs from one such sample application:

Demo App — Manager Access

Demo App — Employee Access

What do you observe?

• Along with their own details, the manager can view the employee details of all their reportees (except some sensitive data like SSN)
• The employees can only see their own information, nothing else

Result: Same query, different visible rows for different roles.

Oracle Database enforces row-level visibility based on the propagated end-user identity.

The application does not need to manually add WHERE manager_id = ... logic in the SQL call. It sends the end-user context to Oracle Database, which applies the security policy consistently via the Deep Data Security configuration.

Why Database-Level Access Control Is Better Than Application Logic

Without Oracle Deep Data Security, the application must implement user/persona-specific data access logic itself — often leading to:

• security vulnerabilities
• heavier, cluttered code
• poor scalability as roles increase
• frequent rewrites for new users/roles

Deep Data Security moves data security enforcement to the database while keeping the application changes optimal and enables high scalability in the system.

Summary

Oracle AI Database Deep Data Security provides powerful policy-based protection for sensitive data. However, modern applications commonly use shared database accounts and connection pools, making it difficult for the database to identify the actual application user.

With node-oracledb 7.0 and beyond, Node.js applications can now supply End User Security Context information to Oracle AI Database. Deep Data Security can then evaluate policies using the real application identity while applications continue using pooled connections and standard SQL.

The result is a scalable architecture that combines:

• Node.js connection pooling
• Oracle AI Database Deep Data Security
• End-user-aware policy enforcement
• Centralized security management

with minimal changes on the Node.js application side.

FAQs

1. What problem does Oracle Deep Data Security solve? Oracle Deep Data Security enforces database-level authorization using the real end-user identity, even when applications use shared database accounts or connection pools. This allows Oracle Database to apply row-, column-, and cell-level access policies consistently, regardless of whether SQL is handwritten, dynamically generated, or produced by AI.

2. How can Node.js applications use Oracle Deep Data Security? Through the node-oracledb driver, which sets an end-user security context object on Oracle Database connections using tokens and identity information.

3. Are there any prerequisites to use Oracle Deep Data Security with Node.js? The Oracle AI Database version must be 23.26.2 RU (26ai). Applications must use Transport Layer Security (TLS) protocol when establishing connections to the database in order to use Oracle Deep Data Security. Also, Oracle Deep Data Security is supported only in node-oracledb Thin mode.

4. Does it require major application changes? No — most changes are configuration-based (e.g., setting the end user context in the connection object), with the database handling enforcement.

5. Why is database-level enforcement better than application-layer control? It ensures consistent, fine-grained access control even with dynamic queries, reducing security gaps and improving scalability.

Resources

Node-oracledb is the official open source Node.js driver for Oracle Database. It supports JavaScript and TypeScript applications, is Thin mode by default, and can optionally use Oracle Client libraries for Thick mode.

• Node-oracledb installation instructions are here.
• Node-oracledb documentation is here.
• Node-oracledb change log is here.
• Issues and questions about node-oracledb can be posted on GitHub or Slack (link to join Slack).
• Follow us on Twitter or Facebook.

Finally, contributions to node-oracledb are more than welcome, see CONTRIBUTING.