AI Agents
Oracle's A2UI Demo Keeps the Agent Away From Transaction Authority
Oracle published a runnable supply-chain reference on September 2 that uses A2UI for allowlisted host-native controls or MCP Apps for sandboxed web interfaces. The agent can propose and present a database-calculated transfer, but Oracle AI Database retains validation, locking, transaction, authorization, and audit authority. It is a documented reference, not an independent security certification.
Citation-ready: Oracle published a September 2, 2026, reference application in which A2UI renders allowlisted native controls or MCP Apps run in a sandbox, while Oracle AI Database retains final transaction and audit authority.
What happened and why it matters
No. In Oracle's reference, A2UI is validated JSON rendered from the host's approved components, while MCP Apps are developer-built sandboxed resources and the database retains final execution authority.
Official Oracle developer reference and repository
Primary reference: Oracle Developers: A2UI and MCP Apps reference application. Kaleido Field checked the event date and the article's attributed facts against this source.
| Source date | September 2, 2026 |
|---|---|
| Checked by Kaleido Field | September 3, 2026, 09:20 CST |
| Source function | current agent-interface analysis separating declarative host-rendered UI, sandboxed MCP Apps, transport protocols, allowlisted database tools, approval handles, database validation, locking, transaction authority, audit, and security testing |
The protocols have different jobs
A2UI describes controls and data for a compatible host to render. MCP Apps package a developer-built web experience. MCP exposes tools, A2A connects agents or hosts, and AG-UI can stream events to a custom frontend.
A review should name the host, supported protocol and version, component catalog, resource sandbox, bridge permissions, transport, agent service, tool server, database role, and the validation performed at each boundary.
Approval should identify immutable work
The reference sends an approval handle and recommendation ID while the service recovers the full recommendation and the database revalidates it under locks. That reduces the chance that editable interface text becomes the transaction payload.
Production testing still needs stale recommendations, duplicate clicks, race conditions, replay, expired approval, conflicting inventory, authorization changes, tool failure, host disconnect, partial commit, audit verification, and rollback.
Evidence boundary
Official technical reference: described architecture, protocol roles and versions, repository, host examples, five allowlisted operations, approval flow, database authority, local tests, and author verification date for named external capabilities. Oracle author claim: the pattern provides safer governed agent applications. Not established: independent security assessment, deployment certification, support by every host version, universal protocol interoperability, production scale, prompt-injection resistance, sandbox escape testing, or transaction-error distribution.
FAQ
Is A2UI generated code?
Oracle describes it as validated declarative JSON rendered with the host's approved native components.
Do MCP Apps automatically use A2UI?
No. The reference treats them as alternative interface paths unless explicitly composed.
Who commits the transfer?
Oracle AI Database retains validation, locking, transaction, authorization, and audit authority.