Topic starter
22/09/2026 3:28 pm
TL;DR: Unosecur says OCI estates have often sat outside mainstream access reviews, leaving users, API keys, auth tokens, customer secret keys and AI agents less visible than the rest of the cloud estate. Bringing Oracle Cloud Infrastructure into identity inventory closes a governance blind spot where least privilege breaks down fastest.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Unosecur extends identity security to Oracle Cloud Infrastructure”.
Key questions
Q: How should teams govern OCI identities that were outside existing access reviews?
A: Treat OCI as part of the core identity estate, not a special cloud exception.
Q: Why do OCI API keys and secret keys create governance risk even when cloud access is read only?
A: Read-only access still creates risk when the keys are not inventoried, tied to owners and reviewed with the policies they can reach.
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Practitioner guidance
- Inventory OCI identities as part of the core identity estate Bring users, roles, groups, API keys, auth tokens, customer secret keys, OAuth client credentials and OCI applications into the same identity register used for the rest of the cloud estate.
- Map OCI policies to reachable compartments and resources Document which policies grant access to which compartments and cloud resources, then review those relationships as a single entitlement path rather than separate objects.
- Include AI agents in access review and offboarding processes Assign owners, review cadence and revocation steps to agents running in OCI so their access is governed with the same lifecycle discipline as other identities.
Bottom line: OCI support closes a cloud governance blind spot by bringing Oracle Cloud identities, machine credentials and AI agents into a shared inventory.
What's in the full announcement
Unosecur's full post covers the operational detail this post intentionally leaves for the source:
- The full OCI inventory workflow for users, roles, groups, keys, tokens and OCI applications
- The policy and compartment context that shows how over-permissioned access actually propagates
- The real-time sync and revoke flow for identities discovered inside an OCI tenancy
- The specific way AI agents are surfaced alongside human and non-human identities
👉 Read Unosecur's OCI identity inventory update for Oracle Cloud Infrastructure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
22/09/2026 3:29 pm
OCI identity blind spots are governance failures, not cloud coverage gaps. When Oracle Cloud sits outside the main access-review programme, the problem is not incomplete documentation. It is that the organisation has accepted a second class of identity governance for a live production environment. That creates a structural exception where entitlement drift, offboarding gaps and unreviewed machine credentials can accumulate. The practitioner lesson is to treat OCI as part of the identity control plane, not as an adjacent cloud silo.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations centralise OCI identity governance with other cloud platforms?
A: Yes, if the goal is consistent least privilege. Separate treatment of OCI creates a review gap where policies, compartments and non-human credentials can escape the controls applied to other clouds. A single governance model makes entitlement drift and partial offboarding easier to detect and fix.
👉 Read our full editorial: OCI identity inventory exposes the access most teams miss
This post was modified 5 days ago by NHI Mgmt Group