Oracle Cloud Infrastructure Documentation

Enterprise AI Governance for OCI Generative AI

Enterprise AI governance ensures AI systems are secure, compliant, and aligned with organizational policies through a combination of infrastructure, access control, and safety enforcement.

Key components include:

  • IAM Policies
    • Control who can access, use, and manage AI resources:
      • Give permission to user groups to access one or more OCI Generative AI resources.
      • Give permission to OCI Generative AI resources to access other OCI services.
      • Give permission to other OCI services to access OCI Generative AI resources.

    See IAM Policies for OCI Generative AI.

  • Private Endpoints
    • Keep model access within a secure network boundary to prevent public exposure.
  • API keys
    • Give access to OCI Generative AI models with unique service generated strings (API keys).
    • Give access to OCI Generative AI API with unique service generated strings (API keys).

    See API Keys.

  • OAuth

    Hosted applications support two authentication methods that use an OCI IAM identity domain:

    • Identity domain bearer token: Clients obtain OAuth access tokens from the identity domain and send them with requests. See Setting Up Identity Domain Bearer Token Authentication.
    • Identity domain browser session: Uses the OAuth 2.1 Authorization Code flow with PKCE. Users sign in through the identity domain, and the hosted application service obtains access tokens on their behalf and establishes browser sessions that use cookies. See Identity domain browser session.

    Hosted applications also support OCI IAM request-signature authentication. For an overview of all three authentication methods, see Authentication.

  • Zero Trust Packet Routing (ZPR)
    • Enforces secure, identity-based communication between services:
      • Create private endpoints in OCI Generative AI service.
      • Add zero trust packet security to the private endpoints.

  • See Managing Security Attributes for Private Endpoints (PE)s.

  • Guardrails
    • Apply runtime safety and compliance controls on inputs and outputs.

Together, these capabilities provide end-to-end governance across access, network security, and AI behavior.