Improve RAG vector classified docs scenario

scenarios/06-rag-vector-classified-docs/README.md

@@ -17,35 +17,32 @@ Before Oracle Deep Data Security, vector search can retrieve confidential HR, le
 
 ## Where To Run The Commands
 
-Run commands from the repository root:
-
-```powershell
-cd C:\Users\rodrigo\Documents\Codex\oracle-deep-data-security-lab
-```
-
-Connect to the database with SQLcl or SQL*Plus:
+Run SQL scripts from the repository root. On Linux/macOS/WSL:
 
 ```bash
-sql "<connect_string>"
+cd ~/DEEP-DATA-SECURITY/oracle-deep-data-security-lab
+export TNS_ADMIN=~/DEEP-DATA-SECURITY/wallet-ddslab
+```
+
+Connect as the lab administrator:
+
+```bash
+sql admin@ddslab_tunnel
 ```
 
 This scenario uses the `VECTOR` type, `TO_VECTOR`, and `VECTOR_DISTANCE`. Use a database version with Oracle AI Vector Search support.
 
+SQLcl note: when running a script with `@file.sql`, press Enter once and wait for the output. Do not type `/` afterward, because `/` reruns the last command in the SQLcl buffer.
+
 ## Step By Step - Before, Vulnerable Environment
 
-1. Connect to the database:
-
-   ```bash
-   sql "<connect_string>"
-   ```
-
-2. Reset the scenario:
+1. Reset the scenario as `ADMIN`:
 
    ```sql
    @scenarios/06-rag-vector-classified-docs/sql/99_reset.sql
    ```
 
-3. Create the chunk table, simple embeddings, and personas:
+2. Create the chunk table, seed classified documents, and create personas:
 
    ```sql
    @scenarios/06-rag-vector-classified-docs/sql/00_schema.sql
@@ -53,35 +50,53 @@ This scenario uses the `VECTOR` type, `TO_VECTOR`, and `VECTOR_DISTANCE`. Use a
    @scenarios/06-rag-vector-classified-docs/sql/02_identities.sql
    ```
 
+3. Show all available chunks as `ADMIN`:
+
+   ```sql
+   SELECT chunk_id, document_title, department, classification, chunk_text
+   FROM dds_rag_chunks
+   ORDER BY chunk_id;
+   ```
+
 4. Simulate the RAG question:
 
    ```text
    Summarize critical documents about renewals, people, and legal risks.
    ```
 
-5. Run the vector search:
+5. Connect as `nina`, a regular employee:
+
+   ```bash
+   sql 'nina/Welcome1_DDS!@ddslab_tunnel'
+   ```
+
+6. Run the vector search before DDS:
 
    ```sql
    @scenarios/06-rag-vector-classified-docs/sql/04_test_queries.sql
    ```
 
-Expected result before protection: retrieval may return `HR_CONFIDENTIAL`, `LEGAL_CONFIDENTIAL`, and `EXECUTIVE_CONFIDENTIAL` chunks.
+Expected result before protection: the retrieval may return `HR_CONFIDENTIAL`, `LEGAL_CONFIDENTIAL`, and `EXECUTIVE_CONFIDENTIAL` chunks to a regular employee because the legacy retrieval role is broad.
 
 ## Step By Step - After, With Deep Data Security
 
-1. Apply data grants by classification:
+1. Reconnect as `ADMIN` and apply data grants by classification:
 
    ```sql
    @scenarios/06-rag-vector-classified-docs/sql/03_data_grants.sql
    ```
 
-2. Run the same vector search again:
+2. Connect as `nina` and run the same vector search:
+
+   ```bash
+   sql 'nina/Welcome1_DDS!@ddslab_tunnel'
+   ```
 
    ```sql
    @scenarios/06-rag-vector-classified-docs/sql/04_test_queries.sql
    ```
 
-3. Repeat the demo by simulating `nina`, `heitor`, `sofia`, and `carlos`.
+3. Repeat the same test as `heitor`, `sofia`, and `carlos`.
 
 Expected result after protection:
 
@@ -108,4 +123,3 @@ Linux/macOS:
 ## Demo Details
 
 See the complete walkthrough, evidence, and official references in [RUNBOOK.md](RUNBOOK.md).
-