Domain 4: Using OCI Generative AI RAG Agents Service (20%)

Domain 4 of the 1Z0-1127-25 Oracle Cloud Infrastructure 2025 Generative AI Professional exam covers the OCI Generative AI Agents service -- a fully managed service for building intelligent virtual agents backed by retrieval-augmented generation (RAG), SQL, and custom tools. This domain represents approximately 10 questions on the 50-question exam (90 minutes, 68% passing score). This is a new domain that did not exist in the 2024 version of the exam (1Z0-1127-24) and tests your knowledge of the managed Agents service as distinct from the manual RAG pipeline covered in Domain 3.

1. Service Fundamentals

What the Agents Service Does

The OCI Generative AI Agents service is a fully managed platform that combines LLMs with knowledge retrieval, SQL generation, API calling, and multi-agent orchestration. Rather than building RAG pipelines from scratch (as in Domain 3 with LangChain + Oracle Database 23ai), the Agents service handles document ingestion, vector indexing, retrieval, and generation in a unified, managed workflow. (OCI GenAI Agents Overview)

Agents Service vs. Manual RAG (Domain 3)

This distinction is critical for the exam. Expect questions that test whether you know when to use each approach.

Exam trap: If a question describes a scenario where someone needs a quick knowledge-base chatbot with built-in guardrails, the answer is the Agents service. If the scenario requires custom chunking strategies, custom embedding models, or fine-grained pipeline control, the answer is the manual RAG approach from Domain 3.

Service Regions

The Agents service is available in 7 regions. Memorize these -- region availability is testable. (OCI GenAI Agents Overview)

2. Architecture and Components

Core Components

The service has a clear component hierarchy. Understanding how these relate to each other is essential for the exam. (OCI GenAI Agents Concepts)

Agent
  |-- Routing LLM (model selection)
  |-- Tool 1 (RAG, SQL, Function Calling, API Endpoint, or Agent)
  |     |-- Knowledge Base (for RAG tools)
  |           |-- Data Source
  |                 |-- Data Store (Object Storage, Oracle DB, OpenSearch, HeatWave MySQL)
  |-- Tool 2 ...
  |-- Endpoint 1
  |     |-- Session(s)
  |     |-- Guardrails (content moderation, PII, prompt injection)
  |-- Endpoint 2 ...

Exam trap: A knowledge base can have only one data source. An agent can have at most two knowledge bases (attached via a RAG tool). These are hard limits. Do not confuse "data source" with "data store" -- the data source is the connection configuration, the data store is the underlying storage system.

Five Tool Types

The Agents service supports five tool types. Know all five and when to use each. (OCI GenAI Agents Getting Started)

Exam trap: The SQL tool only generates SELECT queries. It cannot INSERT, UPDATE, or DELETE. If a question asks about modifying data via natural language, the SQL tool is not the answer.

3. Knowledge Base Creation and Data Stores

Four Supported Data Stores

For the RAG tool, knowledge bases can connect to four types of data stores. (OCI GenAI Agents Getting Started)

Exam trap: Only Object Storage data stores use the automatic ingestion pipeline. For Oracle DB, HeatWave MySQL, and OpenSearch, you bring your own pre-processed data and embeddings. If a question mentions "ingestion job," it is referring to Object Storage.

Object Storage Data Source Details

This is the most common data source for exam questions. (OCI GenAI Agents Object Storage Guidelines)

Supported file formats:

Exam trap: HTML images must use relative paths (e.g., <img src="./image.jpg">). HTTP/HTTPS URLs or absolute paths for images are not supported in HTML files. Markdown images are completely ignored during ingestion.

Metadata filtering: You can attach metadata to files for filtering during chat. Metadata is defined via a _metadata_schema.json file at the bucket root. Supported types are integer, string, list_of_string, and double. Metadata fields cannot be changed or removed after ingestion -- you must recreate the knowledge base. Maximum 20 metadata fields per file. (OCI GenAI Agents Object Storage Guidelines)

Oracle Database Data Source Details

For Oracle AI Database 26ai integration, you must create a database table with required fields (DOCID, BODY, VECTOR) and a retrieval function that accepts a query string and top_k parameter, returning results via SYS_REFCURSOR. The function must use the same embedding model for both stored content and query-time embedding. Connection requires a Database Tools connection with credentials stored in OCI Vault. (OCI GenAI Agents Oracle DB Guidelines)

Exam trap: The database documentation references "Oracle AI Database 26ai," not 23ai. For the exam, know that the Agents service requires a vector search function/procedure in the database -- it does not index or embed your data for you. That is your responsibility (BYO).

Ingestion Jobs

Ingestion jobs apply only to Object Storage data sources. Key facts: (OCI GenAI Agents Data Ingestion)

• Only one active ingestion job per data source at a time
• Maximum 10,000 files per ingestion job (increasable by request)
• Jobs cannot be canceled once started
• Smart restart: When restarting a failed job, the pipeline skips previously successful files and only re-processes updated failed files
• Job statuses: Accepted, Succeeded, Completed with failures, Failed (fix data source), Failed (needs retry), Failed (contact support)

4. Creating and Configuring Agents

Agent Creation Workflow

The standard workflow is: set up IAM policies, prepare data, create an agent with tools, create an endpoint, and chat. (OCI GenAI Agents Create Agent)

Agent configuration includes:

Model Selection

The routing LLM determines which tool to invoke and how to process queries. Three options: (OCI GenAI Agents Model Selection)

Supported model families: Meta Llama (Llama 4 Maverick, Llama 4 Scout, Llama 3.3 70B), OpenAI (gpt-oss-120b, gpt-oss-20b), xAI Grok (Grok 4, Grok 3, Grok 3 Mini, Grok 3 Fast, Grok 3 Mini Fast). Model availability varies by region. (OCI GenAI Agents Model Selection)

Exam trap: The routing LLM and the generation LLM can be different models. The RAG tool has its own generation LLM configuration separate from the agent's routing LLM. Know that you select the routing LLM at the agent level and can select a generation LLM at the RAG tool level.

5. Endpoints, Sessions, and Guardrails

Endpoint Configuration

An endpoint is a deployed instance of an agent. Without an endpoint, the agent cannot receive chat requests. (OCI GenAI Agents Create Endpoint)

Exam trap: Session enable is the only endpoint setting that cannot be changed after creation. All other guardrail and feature settings can be modified later. If the exam asks which setting is permanent at creation time, the answer is session enable.

Guardrail Modes

All three guardrail types (content moderation, prompt injection, PII) support the same three modes:

Large Output Storage

For SQL tool results exceeding 100 rows, endpoints can store results in Object Storage as CSV files. This requires configuring a bucket name, object prefix, and retention period (1-1,440 minutes, default 360 minutes / 6 hours). Results under 100 rows are returned directly. (OCI GenAI Agents Create Endpoint)

6. Multi-Agent Orchestration

Supervisor and Collaborator Architecture

The Agent tool type enables multi-agent orchestration through a supervisor/collaborator pattern. A supervisor agent routes queries to specialized collaborator agents (subagents), each with their own tools and domain expertise. (OCI GenAI Agents Agent-as-Tool Guidelines)

Key rules for the Agent tool:

• Both supervisor and collaborator agents must have session-enabled endpoints (this is critical)
• Collaborator agents can have any combination of tool types (RAG, SQL, Function Calling, etc.)
• Collaborator agents can operate independently and be reused across multiple supervisors
• Collaborator agents can be in different tenancies (cross-tenancy support)
• IAM requires a dynamic group with ALL {resource.type='genaiagent'} and appropriate cross-tenancy policies

Exam trap: If sessions are not enabled on the collaborator agent's endpoint, the Agent tool will not work. Session enablement is required on both the supervisor and all collaborator endpoints.

API Endpoint Calling Tool

The API Endpoint Calling tool lets agents invoke external REST APIs and OCI APIs using an OpenAPI 3.0+ specification. Authentication methods include API Key, Basic Auth, Bearer Token, IDCS, OCI Resource Principal (for OCI APIs), or no authentication. All API calls route through a configured VCN subnet. For state-changing operations (POST, PUT, PATCH, DELETE), the x-requires-approval header triggers human-in-the-loop approval. (OCI GenAI Agents API Endpoint Calling Tool)

7. Invoking Deployed Agents

Chat Workflow

Once an endpoint is active, interaction follows this pattern:

1. User sends a message to the agent endpoint (via Console chat, REST API, or SDK)
2. The routing LLM determines which tool(s) to invoke
3. The selected tool executes (RAG retrieval, SQL generation, API call, etc.)
4. The agent returns the response, optionally with citations and trace information
5. If sessions are enabled, context is maintained for follow-up questions

Developer Access

The service provides two API surfaces and SDKs: (OCI GenAI Agents Concepts)

Additional developer tools: Management CLI, Client CLI, Agent Development Kit (ADK) for Python and Java, and Cloud Shell support.

8. IAM Policies

Resource Types

The Agents service defines eight individual resource types, all grouped under the aggregate genai-agent-family: (OCI GenAI Agents IAM Policies)

Essential Policies

For the exam, know these foundational policy patterns:

Full admin access:

allow group <group> to manage genai-agent-family in tenancy

Model access (required separately -- agents need permission to use LLMs):

allow any-user to use generative-ai-family in tenancy
  where any {request.principal.type='genaiagent'}

Ingestion job access (Object Storage data sources require a dynamic group):

-- Dynamic group matching rule:
ALL {resource.type='genaiagentdataingestionjob'}

-- Policy:
allow dynamic-group <dg> to read objects in compartment <compartment>

Database/Vault access (for Oracle DB, OpenSearch, HeatWave MySQL):

-- Dynamic group matching rule:
ALL {resource.type='genaiagent'}

-- Policies:
allow dynamic-group <dg> to read database-tools-family in compartment <compartment>
allow dynamic-group <dg> to read secret-bundle in compartment <compartment>

Exam trap: There are two different dynamic group resource types. genaiagentdataingestionjob is for ingestion jobs accessing Object Storage. genaiagent is for agent runtime operations (database access, vault secrets, model access). Do not confuse these.

Permission Levels

IAM verbs are cumulative: inspect < read < use < manage. Notable: the use verb on genai-agent-endpoint includes the GENAI_AGENT_ENDPOINT_CHAT permission -- so chat access requires at least use on the endpoint resource.

9. Service Limits

Memorize these limits -- they appear directly in exam questions. (OCI GenAI Agents Limits)

Increasable Limits (Default Values)

Fixed Limits (Cannot Be Increased)

Exam trap: The default limit is 2 agents per tenancy and 3 knowledge bases per tenancy. These are very low defaults and are increasable via service limit requests. Fixed limits (1 data source per KB, 2 KBs per agent) cannot be increased at all. The tools-per-agent limit varies by region -- Frankfurt, London, and Chicago allow 20; other regions allow only 5.

10. SQL Tool Deep Dive

The SQL tool converts natural language to SQL SELECT queries. Key facts for the exam: (OCI GenAI Agents SQL Tool Guidelines)

• Supports only Oracle Database (Base and Autonomous) and SQLite
• Generates only SELECT queries (with joins, conditions, aggregations) -- no DDL or DML
• Requires a valid database schema definition (tables, columns, primary keys, foreign keys, constraints)
• Two model sizes: Small (faster, less accurate, simple queries) and Large (slower, more accurate, complex queries)
• Supports in-context learning examples (sample question/SQL pairs) to improve accuracy
• SQL execution requires a Database Tools connection
• Results over 100 rows can be stored in Object Storage as CSV
• Human-in-the-loop allows review of generated SQL before execution
• Self-correction: agent validates and corrects queries when execution is enabled
• No cross-tenancy or cross-region support for SQL tool

11. Common Exam Scenarios

References

• OCI Generative AI Agents Service Home
• OCI GenAI Agents Concepts
• OCI GenAI Agents Overview
• Getting Started with OCI GenAI Agents
• IAM Policies for OCI GenAI Agents
• RAG Tool Object Storage Guidelines
• RAG Tool Oracle Database Guidelines
• RAG Tool HeatWave MySQL Guidelines
• RAG Tool OpenSearch Guidelines
• Creating an Agent
• Creating an Endpoint
• Model Selection
• Service Limits and Limitations
• Agent-as-Tool Guidelines
• API Endpoint Calling Tool Guidelines
• SQL Tool Guidelines
• Data Ingestion
• 1Z0-1127-25 Exam Syllabus (DBExam)