The consolidation brings together legacy systems like Oracle Access Manager (OAM) and Oracle Identity Manager (OIM) with Oracle Identity Cloud Service (IDCS), Oracle’s first cloud-native identity layer, and the infrastructure authorization capabilities built into Oracle Cloud Infrastructure (OCI). The result combines identity domains with IAM policies, giving customers one place to manage security across infrastructure, SaaS applications, workloads, and AI services.
Open standards form the backbone of the platform. SAML and OpenID Connect handle federation and sign-in. OAuth manages delegated authorization. SCIM automates account lifecycle and provisioning. FIDO2 enables passkey authentication. These protocols provide consistent integration patterns regardless of what is connecting.
What the Platform Actually Covers
Oracle’s own Fusion Applications now use OCI IAM for authentication, SSO, and MFA. Oracle Health and AI services integrate natively, including Oracle Health Clinical Data Exchange, which uses identity domains and OAuth bearer tokens. AI agents acting on behalf of users can receive delegated authority, with the identity context carried through as work moves between human and automated systems.
The full access journey runs through a single control surface:
- SCIM provisioning automates account creation and removal
- Authentication uses OpenID Connect, SAML, MFA, and FIDO passkeys
- Authorization relies on OCI IAM policies and OAuth scopes
- Identity Threat Detection and Response (ITDR) monitors risk signals like suspicious IP addresses and informs Adaptive Access policies
- Audit logs covering sign-in and administrator activity feed into SIEM systems
How Oracle Applies This Internally
Oracle is running the same platform against its own operations, not just offering it to customers. Internal migration moves employee application access from OAM to OCI IAM identity domains, replacing reusable passwords with FIDO2 passkeys and cryptographic sign-in. Production operators receive just-in-time grants scoped to approved work rather than standing access. Automated workloads use workload identity federation for temporary credentials, removing long-lived provider keys from configurations entirely.
On the AI side, Oracle’s internal Enterprise ChatGPT deployment connects to internal systems via MCP under standard employee permissions. An Identity Assurance layer adds facial biometric verification to confirm the person behind a session is who the account says they are.
Hashlytics Take
The agentic security piece is what makes this more than a routine IAM consolidation announcement. The problem Oracle is solving is one that most enterprise identity frameworks were not designed for: an AI agent acting on behalf of a user needs to carry that user’s delegated authority through a chain of systems, without accumulating more permissions than the original request justified, and without the identity context getting dropped somewhere in the middle. Oracle’s answer is to treat agents as first-class principals in the same framework that governs humans and workloads. Whether that holds up under real agentic workloads is a separate question, but it is the right architectural instinct. The broader industry still has not agreed on what agentic identity should look like, and Oracle is early enough here that this could become a reference implementation.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
