Where IT careers
get discussed.

OIC 26.10 shipped the MCP Gateway in September, and I have been reading through how it is meant to work. Instead of pointing every AI agent straight at every MCP server (OIC-hosted or third-party), agents connect to one gateway endpoint. The gateway handles identity, tool filtering, policies (Oracle’s demo shows tool filter, PII and business rule policies), credential resolution and audit.

What I like on paper: agents do not hold downstream credentials, and you can expose only approved tools instead of a whole server. What I am still unsure about, because it is a first iteration:

1. How do policies behave when gateway-level, server-level and tool-level rules overlap?
2. Which authentication methods are supported for the MCP clients calling the gateway?
3. Where does the audit data end up, and for how long?
4. Has anyone converted an existing integration into an MCP tool yet? What broke first?

If you have tried it in a test tenant, share what you found. If you have not, tell me which integration you would expose to an agent first, and which one you would never expose without a human approval step.

Full breakdown of the setup flow and common mistakes: https://lanverse.in/blog/oracle-integration-mcp-gateway-26-10

Been digging into Salesforce's Agentforce updates and the terminology alone has shifted fast — "Topics" became "Subagents" back in April 2026, and Agent Script (the compiled, declarative language behind agent behavior) has quietly become the real story, not the point-and-click Canvas builder most of us learned on first.

A few things that stood out:

1. Hybrid reasoning is the actual answer to "can we trust an LLM with business rules." Agent Script splits logic into a deterministic layer (IF/ELSE, guaranteed action sequences — the LLM cannot override these) and a generative layer (natural language reasoning within those boundaries). That's a genuinely different guarantee than "the model usually gets it right."

2. Data masking through the Trust Layer is off by default — for accuracy/performance reasons. Fine for a lot of use cases, but a real design decision for anyone in healthcare or financial services, not something to assume is handled.

3. Agent Script integrates with Agentforce DX and a VS Code extension — meaning agent definitions can live in source control and go through actual CI/CD now, not just Setup configuration.

Questions for the group:

1. Has anyone moved a real production agent from Canvas-only to direct Agent Script authoring? Worth the effort?
2. How are you handling the masking-disabled-by-default setting for regulated clients — turning it back on, or compensating another way?
3. For those doing Data 360 grounding — Agentforce Data Libraries (auto-configured) or custom retrieval setup? What tipped the decision?

Curious how far ahead of the marketing the real implementations actually are.

  Full breakdown here if useful: https://lanverse.in/blog/salesforce-agentforce-agent-script-guide-2026-architecture-career-roadmap

Spent some time going through Oracle's AI Agent Studio docs, the public GitHub repo, and the certification blueprints. A few things genuinely surprised me:

1. The security model is the headline, not the AI. Agents inherit Fusion's existing role-based access control automatically. A manager's agent sees team compensation data because the manager can — an IC's agent can't, for the same reason. No separate security layer to build or audit.

2. There's a hard 60-second response limit on Workflow Team interactions. If you're chaining multiple LLM calls plus an External REST invocation, that ceiling is a real architectural constraint — same energy as OIC's thread timeout limits.

3. The five tools (Business Object, Document, Email, Deep Link, External REST) feel very familiar if you come from OIC — basically adapters and actions with different names. And OIC 26.07 added a native A2A action to invoke Agent Studio agents directly from integration flows, so the two are clearly converging.

4. Two certifications already exist — 1Z0-1145-1 (Foundations Associate) and 1Z0-1155-2 (Developer, 90 min / 50 questions / 68% pass, validated against 26A).