Add legacy AI, RAG vector and Data Safe audit scenarios

scenarios/06-rag-vector-classified-docs/README.md

@@ -0,0 +1,34 @@
+# 06 - RAG Vector Classified Docs
+
+## Objetivo
+
+Demonstrar que um agente RAG ou copilot interno so recupera documentos e chunks autorizados para o usuario final antes de enviar contexto ao LLM.
+
+## Risco De Negocio
+
+Em RAG, o vazamento muitas vezes acontece antes da resposta do modelo: o mecanismo de busca recupera documentos demais e entrega contexto sensivel ao LLM. Este lab mostra como classificar documentos e aplicar Deep Data Security sobre os chunks recuperaveis.
+
+## Personas
+
+- `nina`: colaboradora comum.
+- `heitor`: RH.
+- `sofia`: juridico.
+- `carlos`: executivo.
+
+## Narrativa Da Demo
+
+1. O agente recebe a pergunta: "resuma documentos criticos sobre renovacoes, pessoas e riscos legais".
+2. A busca por similaridade tenta recuperar todos os chunks.
+3. Deep Data Security limita os chunks por classificacao e departamento.
+4. O LLM so recebe contexto autorizado.
+
+## Observacao Sobre Vetores
+
+O script usa uma coluna `VECTOR(3, FLOAT32)` para manter o lab simples e demonstravel. Em um ambiente real, substitua por embeddings gerados pelo seu modelo e ajuste a metrica de similaridade.
+
+## Execucao
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\run-scenario.ps1 -Scenario 06-rag-vector-classified-docs -ConnectString "<connect_string>"
+```
+

scenarios/06-rag-vector-classified-docs/evidence/expected-results.md

@@ -0,0 +1,8 @@
+# Expected Results
+
+- `nina` retrieves only `PUBLIC` and `INTERNAL` chunks.
+- `heitor` retrieves `HR_CONFIDENTIAL` plus public/internal chunks.
+- `sofia` retrieves `LEGAL_CONFIDENTIAL` plus public/internal chunks.
+- `carlos` retrieves all classifications.
+- The RAG layer receives only chunks authorized by the database policy.
+

scenarios/06-rag-vector-classified-docs/metadata.yaml

@@ -0,0 +1,15 @@
+id: "06-rag-vector-classified-docs"
+title: "RAG Vector Classified Docs"
+criticality: "critical"
+estimated_time_minutes: 30
+audience:
+  - ciso
+  - ai-governance
+  - appsec
+  - data-platform
+products:
+  - "Oracle Deep Data Security"
+  - "Oracle AI Vector Search"
+  - "Oracle AI Database"
+reset_supported: true
+

scenarios/06-rag-vector-classified-docs/sql/00_schema.sql

@@ -0,0 +1,11 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+CREATE TABLE dds_rag_chunks (
+  chunk_id        NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  document_title VARCHAR2(160) NOT NULL,
+  department     VARCHAR2(40) NOT NULL,
+  classification VARCHAR2(30) NOT NULL,
+  chunk_text     VARCHAR2(1000) NOT NULL,
+  embedding      VECTOR(3, FLOAT32)
+);
+

scenarios/06-rag-vector-classified-docs/sql/01_seed_data.sql

@@ -0,0 +1,19 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
+VALUES ('Benefits Policy', 'HR', 'INTERNAL', 'General benefits policy available to employees.', TO_VECTOR('[0.10,0.20,0.30]'));
+
+INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
+VALUES ('Executive Compensation Plan', 'HR', 'HR_CONFIDENTIAL', 'Compensation calibration for executives and retention risks.', TO_VECTOR('[0.11,0.21,0.31]'));
+
+INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
+VALUES ('Contract Renewal Risk', 'LEGAL', 'LEGAL_CONFIDENTIAL', 'Legal risk on renewal clauses for strategic accounts.', TO_VECTOR('[0.80,0.10,0.20]'));
+
+INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
+VALUES ('Company Travel Guide', 'GENERAL', 'PUBLIC', 'Public travel and expense guidance for all employees.', TO_VECTOR('[0.20,0.70,0.10]'));
+
+INSERT INTO dds_rag_chunks (document_title, department, classification, chunk_text, embedding)
+VALUES ('Board M&A Briefing', 'EXEC', 'EXECUTIVE_CONFIDENTIAL', 'Potential acquisition targets and board-level financial exposure.', TO_VECTOR('[0.90,0.20,0.40]'));
+
+COMMIT;
+

scenarios/06-rag-vector-classified-docs/sql/02_identities.sql

@@ -0,0 +1,17 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+CREATE END USER nina IDENTIFIED BY "Welcome1_DDS!";
+CREATE END USER heitor IDENTIFIED BY "Welcome1_DDS!";
+CREATE END USER sofia IDENTIFIED BY "Welcome1_DDS!";
+CREATE END USER carlos IDENTIFIED BY "Welcome1_DDS!";
+
+CREATE DATA ROLE rag_employee_role;
+CREATE DATA ROLE rag_hr_role;
+CREATE DATA ROLE rag_legal_role;
+CREATE DATA ROLE rag_exec_role;
+
+GRANT DATA ROLE rag_employee_role TO nina;
+GRANT DATA ROLE rag_hr_role TO heitor;
+GRANT DATA ROLE rag_legal_role TO sofia;
+GRANT DATA ROLE rag_exec_role TO carlos;
+

scenarios/06-rag-vector-classified-docs/sql/03_data_grants.sql

@@ -0,0 +1,27 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+CREATE OR REPLACE DATA GRANT rag_public_internal_docs
+  AS SELECT (chunk_id, document_title, department, classification, chunk_text, embedding)
+  ON dds_rag_chunks
+  WHERE classification IN ('PUBLIC', 'INTERNAL')
+  TO rag_employee_role;
+
+CREATE OR REPLACE DATA GRANT rag_hr_docs
+  AS SELECT
+  ON dds_rag_chunks
+  WHERE classification IN ('PUBLIC', 'INTERNAL', 'HR_CONFIDENTIAL')
+  TO rag_hr_role;
+
+CREATE OR REPLACE DATA GRANT rag_legal_docs
+  AS SELECT
+  ON dds_rag_chunks
+  WHERE classification IN ('PUBLIC', 'INTERNAL', 'LEGAL_CONFIDENTIAL')
+  TO rag_legal_role;
+
+CREATE OR REPLACE DATA GRANT rag_exec_docs
+  AS SELECT
+  ON dds_rag_chunks
+  TO rag_exec_role;
+
+SET USE DATA GRANTS ONLY ON dds_rag_chunks ENABLED;
+

scenarios/06-rag-vector-classified-docs/sql/04_test_queries.sql

@@ -0,0 +1,15 @@
+SET PAGESIZE 100
+SET LINESIZE 220
+
+PROMPT RAG retrieval simulation: retrieve chunks closest to the question embedding.
+
+SELECT chunk_id,
+       document_title,
+       department,
+       classification,
+       chunk_text,
+       VECTOR_DISTANCE(embedding, TO_VECTOR('[0.85,0.15,0.25]'), COSINE) AS distance
+FROM dds_rag_chunks
+ORDER BY distance
+FETCH FIRST 5 ROWS ONLY;
+

scenarios/06-rag-vector-classified-docs/sql/99_reset.sql

@@ -0,0 +1,29 @@
+BEGIN EXECUTE IMMEDIATE 'SET USE DATA GRANTS ONLY ON dds_rag_chunks DISABLED'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT rag_public_internal_docs'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT rag_hr_docs'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT rag_legal_docs'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT rag_exec_docs'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP TABLE dds_rag_chunks PURGE'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE rag_employee_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE rag_hr_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE rag_legal_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE rag_exec_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP END USER nina'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP END USER heitor'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP END USER sofia'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP END USER carlos'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+

scenarios/06-rag-vector-classified-docs/tests/negative_tests.sql

@@ -0,0 +1,6 @@
+PROMPT Negative test: common employee must not retrieve HR, LEGAL or EXEC confidential chunks.
+SELECT classification, COUNT(*) AS visible_chunks
+FROM dds_rag_chunks
+GROUP BY classification
+ORDER BY classification;
+

scenarios/06-rag-vector-classified-docs/tests/positive_tests.sql

@@ -0,0 +1,3 @@
+PROMPT Positive test: authorized RAG users retrieve only allowed classified chunks.
+@../sql/04_test_queries.sql
+