rodrigo.pace/oracle-deep-data-security-lab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add legacy AI, RAG vector and Data Safe audit scenarios
Some checks failed
Repo Quality / structure (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Rodrigo Pace
2026-05-08 12:21:47 -03:00
parent 5cd8752a90
commit 703e072682
37 changed files with 686 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
scenarios/05-legacy-app-ai-extension/README.md Normal file
View File

@@ -0,0 +1,41 @@
# 05 - Legacy App AI Extension
## Objetivo
Demonstrar como uma aplicacao legada pode ser ampliada com um agente AI sem reescrever toda a autorizacao da aplicacao.
## Risco De Negocio
Aplicacoes legadas normalmente usam uma conta tecnica, regras de autorizacao espalhadas no codigo e consultas historicas dificeis de revisar. Ao adicionar um agente AI ou copilot sobre o mesmo schema, o risco e expor carteira, margem, risco de cliente, tickets e contratos alem do perfil do usuario final.
## Personas
- `joao`: vendedor regional.
- `ana`: gerente comercial Brasil.
- `maria`: atendimento ao cliente.
- `sofia`: juridico.
- `legacy_app`: conta tecnica da aplicacao existente.
- `ai_agent_app`: conta tecnica do novo agente AI.
## Narrativa Da Demo
1. A aplicacao legada continua usando sua conta tecnica.
2. Um novo agente AI consulta os mesmos dados para responder perguntas de negocio.
3. O agente tenta consultar clientes de alto risco, contratos e tickets sensiveis.
4. Deep Data Security aplica data grants pelo contexto do usuario final.
5. O banco retorna apenas linhas e colunas autorizadas, sem depender de uma reescrita completa da aplicacao legada.
## Execucao
```powershell
powershell -ExecutionPolicy Bypass -File .\scripts\run-scenario.ps1 -Scenario 05-legacy-app-ai-extension -ConnectString "<connect_string>"
```
## Resultado Esperado
- `joao` ve somente sua carteira e nao ve margem.
- `ana` ve clientes do Brasil e metricas comerciais regionais.
- `maria` ve tickets de atendimento, mas nao ve margem ou clausulas juridicas.
- `sofia` ve contratos e campos juridicos.
- O mesmo SQL amplo retorna resultados diferentes por persona.

8
scenarios/05-legacy-app-ai-extension/evidence/expected-results.md Normal file
View File

@@ -0,0 +1,8 @@
# Expected Results
- `joao` sees only customers where `account_owner = joao`; `margin` and `legal_hold` are not visible.
- `ana` sees Brazil customers and commercial metrics, but not legal hold.
- `maria` sees support-relevant customer and ticket data, but not margin, legal clauses or private notes.
- `sofia` sees legal-hold customers and legal contract clauses.
- The legacy app can keep its technical connectivity while the AI extension is governed by end-user context.

14
scenarios/05-legacy-app-ai-extension/metadata.yaml Normal file
View File

@@ -0,0 +1,14 @@
id: "05-legacy-app-ai-extension"
title: "Legacy App AI Extension"
criticality: "critical"
estimated_time_minutes: 30
audience:
- ciso
- enterprise-architect
- appsec
- dba
products:
- "Oracle Deep Data Security"
- "Oracle AI Database"
reset_supported: true

32
scenarios/05-legacy-app-ai-extension/sql/00_schema.sql Normal file
View File

@@ -0,0 +1,32 @@
WHENEVER SQLERROR EXIT SQL.SQLCODE
CREATE TABLE dds_legacy_customers (
customer_id NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
customer_name VARCHAR2(100) NOT NULL,
country VARCHAR2(40) NOT NULL,
region VARCHAR2(30) NOT NULL,
account_owner VARCHAR2(60) NOT NULL,
risk_rating VARCHAR2(20) NOT NULL,
revenue NUMBER(12,2),
margin NUMBER(12,2),
legal_hold VARCHAR2(1) DEFAULT 'N' NOT NULL
);
CREATE TABLE dds_legacy_contracts (
contract_id NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
customer_id NUMBER NOT NULL REFERENCES dds_legacy_customers(customer_id),
contract_status VARCHAR2(30) NOT NULL,
renewal_date DATE,
legal_clause VARCHAR2(400),
contract_value NUMBER(12,2)
);
CREATE TABLE dds_legacy_tickets (
ticket_id NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
customer_id NUMBER NOT NULL REFERENCES dds_legacy_customers(customer_id),
assigned_group VARCHAR2(40) NOT NULL,
severity VARCHAR2(20) NOT NULL,
summary VARCHAR2(200) NOT NULL,
private_note VARCHAR2(400)
);

36
scenarios/05-legacy-app-ai-extension/sql/01_seed_data.sql Normal file
View File

@@ -0,0 +1,36 @@
WHENEVER SQLERROR EXIT SQL.SQLCODE
INSERT INTO dds_legacy_customers (customer_name, country, region, account_owner, risk_rating, revenue, margin, legal_hold)
VALUES ('Banco Aurora', 'Brazil', 'LATAM', 'joao', 'HIGH', 2500000, 620000, 'Y');
INSERT INTO dds_legacy_customers (customer_name, country, region, account_owner, risk_rating, revenue, margin, legal_hold)
VALUES ('Varejo Sol', 'Brazil', 'LATAM', 'joao', 'MEDIUM', 900000, 150000, 'N');
INSERT INTO dds_legacy_customers (customer_name, country, region, account_owner, risk_rating, revenue, margin, legal_hold)
VALUES ('Andes Pay', 'Chile', 'LATAM', 'carla', 'HIGH', 1800000, 410000, 'N');
INSERT INTO dds_legacy_customers (customer_name, country, region, account_owner, risk_rating, revenue, margin, legal_hold)
VALUES ('Northwind Insurance', 'USA', 'NA', 'natalie', 'HIGH', 3300000, 900000, 'Y');
INSERT INTO dds_legacy_contracts (customer_id, contract_status, renewal_date, legal_clause, contract_value)
SELECT customer_id, 'RENEWAL', DATE '2026-10-31', 'Penalty clause under legal review', 2500000
FROM dds_legacy_customers WHERE customer_name = 'Banco Aurora';
INSERT INTO dds_legacy_contracts (customer_id, contract_status, renewal_date, legal_clause, contract_value)
SELECT customer_id, 'ACTIVE', DATE '2027-03-15', 'Standard commercial clause', 900000
FROM dds_legacy_customers WHERE customer_name = 'Varejo Sol';
INSERT INTO dds_legacy_contracts (customer_id, contract_status, renewal_date, legal_clause, contract_value)
SELECT customer_id, 'RENEWAL', DATE '2026-08-20', 'Cross-border data clause', 1800000
FROM dds_legacy_customers WHERE customer_name = 'Andes Pay';
INSERT INTO dds_legacy_tickets (customer_id, assigned_group, severity, summary, private_note)
SELECT customer_id, 'SUPPORT', 'HIGH', 'API latency in payment flow', 'Customer reported escalation to board'
FROM dds_legacy_customers WHERE customer_name = 'Banco Aurora';
INSERT INTO dds_legacy_tickets (customer_id, assigned_group, severity, summary, private_note)
SELECT customer_id, 'SUPPORT', 'MEDIUM', 'Portal access issue', 'No sensitive escalation'
FROM dds_legacy_customers WHERE customer_name = 'Varejo Sol';
COMMIT;

22
scenarios/05-legacy-app-ai-extension/sql/02_identities.sql Normal file
View File

@@ -0,0 +1,22 @@
WHENEVER SQLERROR EXIT SQL.SQLCODE
CREATE USER legacy_app IDENTIFIED BY "Welcome1_Legacy!" ACCOUNT UNLOCK;
CREATE USER ai_agent_app IDENTIFIED BY "Welcome1_Agent!" ACCOUNT UNLOCK;
GRANT CREATE SESSION TO legacy_app;
GRANT CREATE SESSION TO ai_agent_app;
CREATE END USER joao IDENTIFIED BY "Welcome1_DDS!";
CREATE END USER ana IDENTIFIED BY "Welcome1_DDS!";
CREATE END USER maria IDENTIFIED BY "Welcome1_DDS!";
CREATE END USER sofia IDENTIFIED BY "Welcome1_DDS!";
CREATE DATA ROLE legacy_sales_rep_role;
CREATE DATA ROLE legacy_brazil_manager_role;
CREATE DATA ROLE legacy_support_role;
CREATE DATA ROLE legacy_legal_role;
GRANT DATA ROLE legacy_sales_rep_role TO joao;
GRANT DATA ROLE legacy_brazil_manager_role TO ana;
GRANT DATA ROLE legacy_support_role TO maria;
GRANT DATA ROLE legacy_legal_role TO sofia;

54
scenarios/05-legacy-app-ai-extension/sql/03_data_grants.sql Normal file
View File

@@ -0,0 +1,54 @@
WHENEVER SQLERROR EXIT SQL.SQLCODE
CREATE OR REPLACE DATA GRANT legacy_sales_customer_access
AS SELECT (customer_id, customer_name, country, region, account_owner, risk_rating, revenue)
ON dds_legacy_customers
WHERE account_owner = ORA_END_USER_CONTEXT.username
TO legacy_sales_rep_role;
CREATE OR REPLACE DATA GRANT legacy_manager_customer_access
AS SELECT (ALL COLUMNS EXCEPT legal_hold)
ON dds_legacy_customers
WHERE country = 'Brazil'
TO legacy_brazil_manager_role;
CREATE OR REPLACE DATA GRANT legacy_support_customer_access
AS SELECT (customer_id, customer_name, country, region, account_owner, risk_rating)
ON dds_legacy_customers
WHERE region = 'LATAM'
TO legacy_support_role;
CREATE OR REPLACE DATA GRANT legacy_legal_customer_access
AS SELECT
ON dds_legacy_customers
WHERE legal_hold = 'Y'
TO legacy_legal_role;
CREATE OR REPLACE DATA GRANT legacy_sales_contract_access
AS SELECT (contract_id, customer_id, contract_status, renewal_date, contract_value)
ON dds_legacy_contracts
WHERE customer_id IN (
SELECT customer_id FROM dds_legacy_customers
WHERE account_owner = ORA_END_USER_CONTEXT.username
)
TO legacy_sales_rep_role;
CREATE OR REPLACE DATA GRANT legacy_legal_contract_access
AS SELECT
ON dds_legacy_contracts
WHERE customer_id IN (
SELECT customer_id FROM dds_legacy_customers
WHERE legal_hold = 'Y'
)
TO legacy_legal_role;
CREATE OR REPLACE DATA GRANT legacy_support_ticket_access
AS SELECT (ticket_id, customer_id, assigned_group, severity, summary)
ON dds_legacy_tickets
WHERE assigned_group = 'SUPPORT'
TO legacy_support_role;
SET USE DATA GRANTS ONLY ON dds_legacy_customers ENABLED;
SET USE DATA GRANTS ONLY ON dds_legacy_contracts ENABLED;
SET USE DATA GRANTS ONLY ON dds_legacy_tickets ENABLED;

18
scenarios/05-legacy-app-ai-extension/sql/04_test_queries.sql Normal file
View File

@@ -0,0 +1,18 @@
SET PAGESIZE 100
SET LINESIZE 220
PROMPT Agent AI question: "List all high-risk customers, margin, legal holds, renewals and support notes."
SELECT customer_id, customer_name, country, region, account_owner, risk_rating, revenue, margin, legal_hold
FROM dds_legacy_customers
WHERE risk_rating = 'HIGH'
ORDER BY customer_id;
SELECT c.contract_id, c.customer_id, c.contract_status, c.renewal_date, c.legal_clause, c.contract_value
FROM dds_legacy_contracts c
ORDER BY c.contract_id;
SELECT ticket_id, customer_id, assigned_group, severity, summary, private_note
FROM dds_legacy_tickets
ORDER BY ticket_id;

47
scenarios/05-legacy-app-ai-extension/sql/99_reset.sql Normal file
View File

@@ -0,0 +1,47 @@
BEGIN EXECUTE IMMEDIATE 'SET USE DATA GRANTS ONLY ON dds_legacy_tickets DISABLED'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'SET USE DATA GRANTS ONLY ON dds_legacy_contracts DISABLED'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'SET USE DATA GRANTS ONLY ON dds_legacy_customers DISABLED'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_sales_customer_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_manager_customer_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_support_customer_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_legal_customer_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_sales_contract_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_legal_contract_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT legacy_support_ticket_access'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP TABLE dds_legacy_tickets PURGE'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP TABLE dds_legacy_contracts PURGE'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP TABLE dds_legacy_customers PURGE'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP USER legacy_app CASCADE'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP USER ai_agent_app CASCADE'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE legacy_sales_rep_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE legacy_brazil_manager_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE legacy_support_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE legacy_legal_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP END USER joao'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP END USER ana'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP END USER maria'; EXCEPTION WHEN OTHERS THEN NULL; END;
/
BEGIN EXECUTE IMMEDIATE 'DROP END USER sofia'; EXCEPTION WHEN OTHERS THEN NULL; END;
/

5
scenarios/05-legacy-app-ai-extension/tests/negative_tests.sql Normal file
View File

@@ -0,0 +1,5 @@
PROMPT Negative test: broad AI-style queries must not expose all customers, margins, legal clauses or private notes.
SELECT COUNT(*) AS visible_customers FROM dds_legacy_customers;
SELECT COUNT(*) AS visible_contracts FROM dds_legacy_contracts;
SELECT COUNT(*) AS visible_tickets FROM dds_legacy_tickets;

3
scenarios/05-legacy-app-ai-extension/tests/positive_tests.sql Normal file
View File

@@ -0,0 +1,3 @@
PROMPT Positive test: each persona receives only the authorized slice from the legacy dataset.
@../sql/04_test_queries.sql