Oracle has expanded OCI Identity Assurance, the biometric verification feature in its cloud identity and access management service, and plans to use it to verify the people who approve sensitive actions requested by AI agents. The company detailed the update alongside Oracle AI Security Mesh, a new vulnerability-remediation service that uses OpenAI’s cyber models.
Before sensitive actions such as releasing payments or changing access permissions, Identity Assurance can use biometrics to verify the identity and presence of the person giving approval. In AI agent workflows, Oracle says this helps establish that an approval came from a verified person. An agent might prepare a payment, request a salary change or start a privileged operation, and the application can require fresh verification from the authorized person before proceeding.
Oracle’s product blog describes that agent-approval capability as coming in the future. It says step-up verification is also planned for sensitive operations such as bank-account updates in Oracle Fusion HCM.
Oracle first announced Identity Assurance in March with facial scans checked against government-issued IDs. The service now uses a faceprint, fingerprint or voiceprint and, where configured, government ID documents. Users enroll once to create a protected reference, such as a facial embedding, fingerprint template or voiceprint, and later samples are compared with it using liveness and anti-spoofing checks.
Built into OCI Identity and Access Management, the feature works across Oracle Cloud services, including OCI and Oracle applications. Oracle says the combination of document checks and biometrics can help detect impostors, including those involved in North Korean IT worker schemes, while later checks can uncover impersonation and account handoffs. Verification signals are sent to OCI Audit, with OCI Cloud Guard support planned.
For data protection, Oracle says it stores encrypted facial embeddings rather than enrollment images, isolated by identity domain and kept separately from IAM. Mobile verification uses hardware-backed keys on iOS and Android, and raw depth maps stay on the device. Fingerprint verification uses protected templates with presentation attack detection, and speech recordings used for voice checks are not retained. Users can unenroll to delete their biometric data.
“With Oracle AI Security Mesh and Oracle’s identity and network security capabilities, we’re helping organizations identify and resolve security risks faster while maintaining control over who can authorize sensitive actions and which systems AI workloads can access,” said Phil Newman, Oracle’s senior vice president for security and identity.
Sources: PR Newswire, Oracle
–
By the ID Tech Editorial Team
