Oracle’s NL2SQL blueprint makes metadata a second sensitive data plane

Oracle’s reference architecture for an MCP-powered NL2SQL agent describes its database tool as performing “secure read-only SQL execution.” That is an important control, but it is not a complete description of the system’s data exposure. The same Oracle blueprint also retrieves schema details, samples data, stores business glossary entries, fetches prior natural-language/SQL examples and preserves conversational context.

The practical lesson is simple: read-only execution does not make the surrounding agent read-only or stateless.

Inventory the second data plane

Oracle’s design separates a Next.js frontend, a FastAPI backend, a LangGraph loop and two FastMCP servers on Oracle Kubernetes Engine. The NL2SQL MCP server connects directly to Oracle Database for schema search, sampling, query execution and insight generation. The backend manages persistence in Autonomous Database, sends message history into the agent loop and streams the final answer alongside execution metadata, including the SQL that ran.

That creates a metadata-and-context plane beside the warehouse itself. Oracle says the vector store may contain embeddings for tables, columns and relationships; business definitions and synonyms; thousands of earlier question/SQL pairs; and each user’s query history. Those records can reveal business terminology, schema shape, sensitive entity names, access patterns and reusable query logic even when the SQL endpoint cannot write to source tables.

Test controls at every hop

A deployment review should therefore trace four paths separately:

1. Retrieval: Which schemas, samples, glossary entries and prior examples can the MCP tool return for this identity?
2. Persistence: What does the backend store in Autonomous Database, for how long, and under which deletion policy?
3. Prompt assembly: Can one user’s history or retrieved examples enter another user’s model context?
4. Output: Where are generated SQL, result rows, charts and execution metadata logged or streamed?

Oracle says MCP tools can inherit OCI identity, roles, row-level controls, Virtual Private Database policies and masking. The post also explicitly tells implementers to run privacy, security and compliance reviews before connecting an MCP server or exposing enterprise data. Those two statements belong together: policy passthrough is a design claim to verify, not a substitute for tracing the request end to end.

A useful acceptance test

Create two users whose warehouse permissions differ, then ask semantically equivalent questions. Compare not only the final rows, but also retrieved schema candidates, sampled values, glossary context, example queries, generated SQL, logs and follow-up memory. Repeat after a role change and after deleting a chat.

The test passes only if restricted metadata never crosses the boundary and persisted context follows the same lifecycle as the underlying authorization. A failed write attempt proves very little about either condition.

Oracle’s architecture is valuable precisely because it names the components practitioners must assess. Its bigger lesson is that the NL2SQL security boundary now includes the context assembled before SQL runs and the artifacts retained after the result returns.