Console AI Experience Preview Availability

Services: Console
Release Date: July 28, 2026

Console AI is a new conversational experience in the OCI Console that helps you work faster using natural language. It supports a wide range of use cases, including exploring resources, creating and managing supported OCI resources, troubleshooting issues, understanding billing and usage, and learning how to complete common OCI tasks.

Console AI operates within your current existing OCI Identity and Access Management (IAM) permissions. It uses your OCI context, including your selected region, compartments, resources, and permissions, to provide relevant guidance and run supported workflows on your behalf. Actions that modify resources always require your review and approval.

Availability

Console AI Experience Preview is available:

To Free Tier and Always Free customers whose home region is one of these:
- Ashburn
- Chicago
- Frankfurt
- Hyderabad
- London
- Osaka
- Phoenix
- Riyadh
- São Paulo
To commercial OCI customers in the OC1 realm whose home region is one of these:
- US East (Ashburn) (IAD)
- US West (Phoenix) (PHX)

We plan to add more home regions for commercial OCI customers over time.

Enable Console AI

To enable and launch Console AI:

Sign in to the OCI Console.
From the Console home page, scroll to Experience Previews.
Select Opt in to experience previews.
Turn on Enable experience.
Select Launch Console AI.

Important Information

Console AI is a limited, pre-production pilot. Do not use Console AI with production data or share sensitive information.
Service Request (SR) creation is not currently supported. Use Ask Oracle to create a service request or engage with a live support agent.

Feedback: We are actively improving Console AI, and your feedback helps shape the experience. To share feedback, select the Help Us Improve link in the Console AI panel or email oci-research-internal-feedback_ww@oracle.com.

Administrative Governance

Governing Console AI access

By default, after users opt in to the preview, Console AI can perform supported actions on their behalf within their existing IAM permissions. Tenancy administrators can further use OCI IAM deny policies to control how Console AI accesses OCI resources on behalf of users. Deny policies add an extra layer of administrative control without changing users' existing permissions for the Console, CLI, SDK, or API.

The following examples illustrate common governance scenarios.

Important

OCI IAM deny policies are an opt-in feature and must be enabled before you can use them. Only members of the default Administrators group in the default identity domain can enable deny policies in the Console. Enabling this feature is permanent. Members of the default Administrators group in the default identity domain are exempt from deny policies.

Restrict OCI resource actions through Console AI for a group
Prevent members of the AIDev group from accessing OCI resources through Console AI:
```
Deny group AIDev to inspect all-resources in tenancy
                                where request.obo-service.name = 'oci-mcp-server'
```
Restrict OCI resource actions through Console AI in a compartment
Prevent members of the Contractors group from accessing OCI resources through Console AI in the Finance compartment:
```
Deny group Contractors to inspect all-resources in compartment Finance
                                where request.obo-service.name = 'oci-mcp-server'
```
Restrict OCI resource actions through Console AI for specific resource types
Prevent members of the Developers group from managing Networking resources through Console AI:
```
Deny group Developers to manage virtual-network-family in tenancy
                                where request.obo-service.name = 'oci-mcp-server'
```
Make OCI resources read-only through Console AI for a group
Instead of fully restricting the AIDev group from accessing OCI resources through Console AI, allow members to view OCI resources but prevent them from creating, updating, or deleting resources:
```
Deny group AIDev to use all-resources in tenancy
                                where request.obo-service.name = 'oci-mcp-server'
```
Members can still perform Console AI operations that require only inspect or read permissions.
Prevent a group from deleting Autonomous Databases through Console AI
Prevent members of the DatabaseDevelopers group from deleting Autonomous Databases through Console AI:
```
Deny group DatabaseDevelopers to manage all-resources in tenancy
                                where ALL {
                                request.obo-service.name = 'oci-mcp-server',
                                request.permission = 'AUTONOMOUS_DATABASE_DELETE'
                                }
```
The request.permission condition limits the deny policy to Autonomous Database delete operations. Members of the group can continue to perform other Console AI operations according to their existing IAM permissions.

Replace the group and compartment names with values from your environment. The request.obo-service.name = 'oci-mcp-server' condition ensures that the policy applies only to requests made through Console AI on behalf of users. This condition doesn't affect access from the Console, CLI, SDK, or API.

Because deny metaverbs are inverted, denying inspect blocks inspect, read, use, and manage. Denying use blocks use and manage, but allows inspect and read.

Considerations for chained tasks

Console AI deny policies are evaluated against the service that makes the OCI API request. As a result, they apply only to requests made directly by the Console AI service principal.

Some Console AI tasks invoke additional OCI services to complete a workflow. For these chained tasks, the deny policy does not apply to downstream requests made by another OCI service.

For example, suppose you create a deny policy that prevents members of the Developers group from managing Networking resources through Console AI:

Deny group Developers to manage virtual-network-family in tenancy
                        where request.obo-service.name = 'oci-mcp-server'

If a user asks Console AI to create a Compute instance, Console AI starts the request, but the Compute service subsequently performs the required Networking operations. Because those downstream requests are made by the Compute service rather than the Console AI service principal, the Console AI deny policy does not apply, and the Networking operations are not blocked. If you need to restrict downstream operations, create additional deny policies that target the appropriate OCI service or resource.

For more information about enabling and using OCI IAM deny policies, see the Oracle Cloud Infrastructure documentation for Deny Policies.

Oracle Cloud Infrastructure Documentation / Release Notes

Console AI Experience Preview Availability