AI Administrator 3.1
Ask Oracle.
Review the plan.
Stay in control.
Ask about your Oracle environment. Get a clear answer. Approve changes only when you are ready.
Oracle credentials stay localEvery change starts with a planEvery result is checked
Your model. Your choice.
Use the AI you already have.
connect the provider account you already use. Fusion Toolkit stays between the LLM and Oracle.
Ollama · Qwen
Keep the conversation local.
With a compatible local agent, prompts and selected answers can stay on your machine.
Codex · Claude · Gemini
Use the account you already have.
The context you share may be processed by that provider under its account and data controls.
In both paths, your Oracle credentials, plans, approvals, and Oracle connection stay on your machine.
Real cases · anonymised
See how three Oracle requests unfold.
These three anonymised development-environment cases show a read-only lookup, an approval reassignment, and a complete bank-creation workflow. Every transcript is shown in full.
Worker information READ ONLY
› in demo1, can you get the default expense account, legal employer and buisness unit of the
employee ALEX EXAMPLE
• I’ll use the repository’s AI Administrator contract to query DEMO1 read-only and trace
Alex Example’s worker assignment and expense defaults. I’ll first verify the configured
environment and available safe query procedures.
───────────────────────────────────────────────────────────────────────────────────────────────
• The current Oracle 26C worker endpoint is the documented read path. I’ll first resolve the
exact worker with minimal identity fields, then fetch only the assignment fields needed for
the expense account, legal employer, and business unit.
• Edited /tmp/alex-example-worker-search.json (+1 -1)
1 {
2 - "filter": "FirstName='ALEX';LastName='EXAMPLE'",
2 + "filter": "DisplayName='Alex Example'",
3 "fields": "PersonId,PersonNumber,DisplayName"
• Running java -jar /home/example/Git/SwissFusionERP-Toolkit/target/
│ fusion-cli-toolkit-3.1.0-cli.jar --profile demo1 --output json ai-admin api execute
│ --recipe worker-search --parameters /tmp/alex-example-worker-search.json
⚠ Automatic approval review approved (risk: low, authorization: high): This is a narrowly
scoped, read-only DEMO1 lookup explicitly requested by the user; the corrected name filter
does not add side effects or untrusted data export.
✔ Auto-reviewer approved codex to run java -jar /home/example/Git/SwissFusionERP-Toolkit/target/
fusion-cli-toolkit-3.1... this time
• Ran java -jar /home/example/Git/SwissFusionERP-Toolkit/target/fusion-cli-toolkit-3.1.0-cli.jar
│ --profile demo1 --output json ai-admin api execute --recipe worker-search --parameters /
│ tmp/alex-example-worker-search.json
└ {"attempts":1,"changed":false,"command":"ai-admin api execute","data":
{"compatibility_warning":false,"documentation_checksum":"44444444444444444444444444444444444
… +15 lines (ctrl + t to view transcript)
[],"schema_version":"2.0","started_at":"2099-08-19T13:17:13.175724748Z","status":"success",
"toolkit_version":"3.1.0","truncated":false}
• Ran jq '{required,additionalProperties,properties}' schemas/api-request.schema.json
└ {
"required": [
… +72 lines (ctrl + t to view transcript)
}
}
• Added /tmp/alex-example-assignment-read.json (+17 -0)
1 +{
2 + "schema_version": "2.0",
3 + "operation_id": "hcm.workers.list",
4 + "method": "GET",
5 + "query": {
6 + "q": "DisplayName='Alex Example'",
7 + "fields": "PersonId,PersonNumber,DisplayName;workRelationships:LegalEmployerName;wo
rkRelationships.assignments:AssignmentNumber,AssignmentStatusType,PrimaryAssignmentFlag
,DefaultExpenseAccount,BusinessUnitName",
8 + "onlyData": true,
9 + "limit": 10
10 + },
11 + "expected_effect": "read-only",
12 + "response_limits": {
13 + "max_items": 10,
14 + "max_pages": 1,
15 + "max_bytes": 1048576
16 + }
17 +}
• Running java -jar /home/example/Git/SwissFusionERP-Toolkit/target/
│ fusion-cli-toolkit-3.1.0-cli.jar --profile demo1 --output json ai-admin api execute
│ --request /tmp/alex-example-assignment-read.json
───────────────────────────────────────────────────────────────────────────────────────────────
• In DEMO1, Alex Example (employee 1000001, active primary assignment E1000001) has:
- Default expense account: DEMO.000000.00000.0.0.0.0.0.0.0.0
- Legal employer: Example Services SA
- Business unit: Demo Business Unit
Read-only lookup against the DEMO1 development environment, effective August 19, 2099. No data
was changed. The fields came from Oracle’s documented Workers REST endpoint
(https://docs.oracle.com/en/cloud/saas/human-resources/farws/op-workers-get.html),
documentation release 26C, cached August 17, 2099.
Expense approver APPROVAL REQUIRED
› in demo1, the expenses 'NDF-DEMO000000000001' is assigned for approval to ALEX
EXAMPLE that is currently out of office, can you reassign this invoice for approval to
JAMIE SAMPLE ?
• I’ll use the repository’s AI Administrator contract to identify the demo1 procedure, verify
the expense and both users, then perform the scoped reassignment and confirm the result.
───────────────────────────────────────────────────────────────────────────────────────────────
• The expense report is uniquely resolved in demo1: ID 300000000000001, status “Pending manager
approval,” submitted by Morgan Demo. Oracle rejected UserName as a projected
worker field, so I’m narrowing the identity lookup to supported fields and will resolve
usernames through the documented user-account resource. The first BPM keyword search returned
no tasks, so I’m also checking the official task-filter syntax before planning the
reassignment.
───────────────────────────────────────────────────────────────────────────────────────────────
• The exact actionable task is now confirmed as task number 700001 (workflow UUID 11111111-…),
assigned to Alex’s active username alex.example@example.invalid. Jamie uniquely resolves to
active username jamie.sample@example.invalid. I’m creating the immutable one-request plan now;
it will not change demo1 until you explicitly approve the displayed plan.
• Running java -jar ../../dist/fusion-cli-toolkit-3.1.0-cli.jar --profile demo1 --output json
│ ai-admin api plan --recipe expense-task-reassign --parameters /tmp/
│ demo1-expense-task-reassign-params.json
───────────────────────────────────────────────────────────────────────────────────────────────
• No change has been made yet. The exact immutable plan is ready:
Profile: demo1
Environment: development
Origin: https://example-dev.fa.ocs.oraclecloud.com
Principal: 00000000 (Toolkit-redacted actor fingerprint)
Expense report:
Number: NDF-DEMO000000000001
ID: 300000000000001
Status: Pending manager approval
Employee: MORGAN DEMO
Amount: 123.45 CHF
Exact approval task:
Task number: 700001
Workflow ID: 11111111-1111-4111-8111-111111111111
State: ASSIGNED
Current: ALEX EXAMPLE
alex.example@example.invalid
Proposed: JAMIE SAMPLE
jamie.sample@example.invalid
Account: active, not suspended
Request:
PUT /bpm/api/4.0/tasks/700001
Body:
{
"action": "REASSIGN",
"assignee": "jamie.sample@example.invalid"
}
Business impact:
Transfers approval responsibility to Jamie. It does not approve or
reject the expense report. Oracle may notify the new assignee.
Recovery:
If still actionable, create and approve a separate plan to reassign the
task back to alex.example@example.invalid.
Verification:
GET /bpm/api/4.0/tasks/700001
Expected assignee: jamie.sample@example.invalid
Documentation:
Oracle BPM REST 26C
Effect: state-changing
Checksum: 4444444444444444444444444444444444444444444444444444444444444444
Source:
https://docs.oracle.com/en/cloud/saas/applications-common/26c/farca/REST-API-for-Common-Features.html
Approval mode: per_request
Plan UUID: 22222222-2222-4222-8222-222222222222
Plan digest: 2222222222222222222222222222222222222222222222222222222222222222
Expires: 2099-08-19 13:36:59 CEST
Single use: yes
The plan’s complete redacted current-state snapshot also binds task 700001 to root task
700000, identification key 300000000000001, workflow FinExmWorkflowExpenseApproval, current
assignee alex.example@example.invalid, state ASSIGNED, priority 3, assignment date 2099-07-07
06:26:19, and the available REASSIGN action. The operation follows Oracle’s documented
task-action endpoint
(https://docs.oracle.com/en/cloud/saas/applications-common/26c/farca/op-bpm-api-4.0-tasks-id-put.html).
Reply approve to execute this exact plan. If it expires or the task changes, I’ll generate
and display a fresh plan.
─ Worked for 7m 01s ───────────────────────────────────────────────────────────────────────────
› approve
• Approval received for compatibility plan 33333333-3333-4333-8333-333333333333. I’m executing
it once and will verify the exact task through the current v4 read endpoint.
• Running java -jar ../../target/fusion-cli-toolkit-3.1.0-cli.jar --profile demo1 --output json
│ ai-admin api apply --plan 33333333-3333-4333-8333-333333333333 --approved
───────────────────────────────────────────────────────────────────────────────────────────────
• Oracle returned HTTP 200 and completed the compatibility write. I’m performing the promised
independent read now; success requires task 700001 to show Jamie as the sole assignee.
• Running java -jar ../../target/fusion-cli-toolkit-3.1.0-cli.jar --profile demo1 --output json
│ ai-admin api execute --request /tmp/demo1-expense-task-item.json
───────────────────────────────────────────────────────────────────────────────────────────────
• Verification passed: task 700001 is still ASSIGNED, now solely to jamie.sample@example.invalid;
Oracle recorded the reassignment at 2099-08-19 11:43:18 UTC. I’m doing a final workspace
check so the handoff accurately reports the supporting Toolkit changes and untouched owner
work.
───────────────────────────────────────────────────────────────────────────────────────────────
• Successfully reassigned in demo1.
- Expense: NDF-DEMO000000000001
- Task: 700001
- Previous approver: ALEX EXAMPLE
- New sole approver: JAMIE SAMPLE (jamie.sample@example.invalid)
- Status: still ASSIGNED, pending approval
- Oracle update time: 2099-08-19 11:43:18 UTC
- Execution: 1 completed, 0 failed
- Verification: passed through an independent v4 task read
Oracle’s v4 mutation returned an internal error without changing the task, so the approved,
documented v3 compatibility endpoint was used successfully. The Toolkit drift guard was also
updated and regression-tested in /home/example/Git/SwissFusionERP-Toolkit/src/main/java/com/
hufflelab/fusiontoolkit/aiadmin/GenericApiService.java and /home/example/Git/SwissFusionERP-
Toolkit/src/test/java/com/hufflelab/fusiontoolkit/aiadmin/GenericApiServiceTest.java.
Existing unrelated website changes were untouched.
Save this use case and its execution history to the local library?
Bank creation TWO APPROVALS
› on demo1, can you add this new bank :
Bank name : Example Bank
Clearing : 99999
Code Swift : EXAMCHZZ
Adress : Musterstrasse 1, 8000 Zurich
• I’ll use the repository’s AI Administrator contract to identify “demo1,” inspect the existing
bank record format, and add Example Bank only after confirming the target environment.
───────────────────────────────────────────────────────────────────────────────────────────────
• Immutable bank-creation plan:
- Profile/environment: demo1 / development
- Origin: https://example-dev.fa.ocs.oraclecloud.com
- Principal: 00000000
- Current state: no exact bank-name or code duplicates found
- Request: POST /fscmRestApi/resources/11.13.18.05/cashBanks
- Payload: {"BankName":"Example Bank","BankNumber":"99999","CountryName":"Switzerland"}
- Impact: creates shared Oracle Financials bank master data
- Verification: unavailable within this POST; I’ll independently query the created bank
afterward
- Recovery: delete only if unused and Oracle permits it; otherwise use a separately reviewed
correction
- Documentation: Oracle Financials 26C
(https://docs.oracle.com/en/cloud/saas/financials/26c/farfa/op-cashbanks-post.html),
checksum 3a7d2a86…ca2bba
- Approval mode: per_request, single-use, never retry an ambiguous result
- Plan ID: 11111111-1111-4111-8111-111111111111
- Digest: 1111111111111111111111111111111111111111111111111111111111111111
- Expires: 2026-08-19 13:18:44 CEST
Reply approve to execute this exact plan. The branch will require a second plan afterward.
─ Worked for 1m 13s ───────────────────────────────────────────────────────────────────────────
› approve
• Approval received for plan 11111111-1111-4111-8111-111111111111. I’m applying that exact
single-use bank plan once, then I’ll independently verify the resulting bank record before
preparing the branch plan.
• Running java -jar /home/user/Git/SwissFusionERP-Toolkit/target/
│ fusion-cli-toolkit-3.1.0-cli.jar --profile demo1 --output json ai-admin api apply
│ --plan 11111111-1111-4111-8111-111111111111 --approved
───────────────────────────────────────────────────────────────────────────────────────────────
• The bank POST returned HTTP 201 and created BankPartyId 300000000000001. Oracle’s response
contained a suspicious generic self-link ending in /1, so I’m relying on an independent
exact-name/code collection query—not that link—to verify the actual record before continuing.
───────────────────────────────────────────────────────────────────────────────────────────────
• Independent verification passed: exactly one demo1 bank exists with ID 300000000000001, party
number 10001, name Example Bank, code 99999, and country Switzerland.
I’m now creating the separate immutable branch plan using demo1’s established Swiss
convention: branch name Zürich - Musterstrasse 1, branch number 99999-0000, and BIC
EXAMCHZZ.
• Edited 2 files (+64 -0)
└ library/local/documentation/financials-cash-bank-branches-26c.json (+49 -0)
1 +{
2 + "schema_version": "2.0",
3 + "id": "oracle-financials-cash-bank-branches-26c",
4 + "source_url": "https://docs.oracle.com/en/cloud/saas/financials/26c/farfa/op-cashbank
branches-post.html",
5 + "title": "REST API for Oracle Fusion Cloud Financials - Create a bank branch",
6 + "product": "Oracle Fusion Cloud Financials",
7 + "published_release": "26C",
8 + "retrieved_at": "2026-08-19T11:05:00Z",
9 + "checksum": "b6b85406a11e24ef94d93c56264c650bb10f0364fa4d3810fc0ed31c74fc0d0a",
10 + "content": "Oracle Financials 26C Bank Branches REST resource uses POST /fscmRestApi/
resources/11.13.18.05/cashBankBranches to create a bank branch. Supported request field
s include BankName, BankNumber, BankBranchName, BankBranchNameAlt, BranchNumber, Branch
NumberType, BankBranchType, CountryName, Description, EDIIdNumber, EDILocation, EFTSWIF
TCode, EFTUserNumber, and RFCIdentifier. EFTSWIFTCode is the BIC used by SWIFT. BranchN
umber is the bank branch number. BankName associates the new branch with an existing ba
nk. Creation changes Oracle master data. Before creation, query exact BIC and branch nu
mber to avoid duplicates. The public REST resource does not expose structured postal-ad
dress fields.",
11 + "operations": [
12 + {
13 + "id": "financials.cash-bank-branches.create",
14 + "method": "POST",
15 + "path_template": "/fscmRestApi/resources/11.13.18.05/cashBankBranches",
16 + "effect": "state-changing",
17 + "path_parameters": [],
18 + "query_parameters": [],
19 + "headers": ["REST-Framework-Version"],
20 + "body_schema": {
21 + "properties": {
22 + "BankName": {"type": "string"},
23 + "BankNumber": {"type": "string"},
24 + "BankBranchName": {"type": "string"},
25 + "BankBranchNameAlt": {"type": "string"},
26 + "BranchNumber": {"type": "string"},
27 + "BranchNumberType": {"type": "string"},
28 + "BankBranchType": {"type": "string"},
29 + "CountryName": {"type": "string"},
30 + "Description": {"type": "string"},
31 + "EDIIdNumber": {"type": "string"},
32 + "EDILocation": {"type": "string"},
33 + "EFTSWIFTCode": {"type": "string"},
34 + "EFTUserNumber": {"type": "string"},
35 + "RFCIdentifier": {"type": "string"}
36 + },
37 + "required": ["BankName", "BankBranchName"],
38 + "additional_properties": false
39 + },
40 + "binary_response": false,
41 + "verification": {"availability": "unavailable"},
42 + "warnings": [
43 + "Creating a bank branch changes shared Oracle Financials master data and can af
fect payment routing selections.",
44 + "Confirm exact bank association, BIC, and branch-number uniqueness before creat
ion.",
45 + "Recovery: delete the branch only if it remains unused and Oracle permits delet
ion; otherwise correct it through a separately reviewed update."
46 + ]
47 + }
48 + ]
49 +}
└ library/local/requests/create-example-bank-branch-demo1.json (+15 -0)
1 +{
2 + "schema_version": "2.0",
3 + "operation_id": "financials.cash-bank-branches.create",
4 + "expected_effect": "state-changing",
5 + "headers": {
6 + "REST-Framework-Version": "4"
7 + },
8 + "body": {
9 + "CountryName": "Switzerland",
10 + "BankName": "Example Bank",
11 + "BankBranchName": "Zürich - Musterstrasse 1",
12 + "BranchNumber": "99999-0000",
13 + "EFTSWIFTCode": "EXAMCHZZ"
14 + }
15 +}
───────────────────────────────────────────────────────────────────────────────────────────────
• Bank creation is verified. Branch plan:
- Profile/environment: demo1 / development
- Origin: https://example-dev.fa.ocs.oraclecloud.com
- Principal: 00000000
- Parent bank: verified Example Bank, ID 300000000000001
- Existing duplicate state: no matching BIC or branch number found
- Request: POST /fscmRestApi/resources/11.13.18.05/cashBankBranches
- Payload: {"BankBranchName":"Zürich - Musterstrasse 1","BankName":"Example
Bank","BranchNumber":"99999-0000","CountryName":"Switzerland","EFTSWIFTCode":"EXAMCHZZ"}
- Impact: creates shared bank-branch master data affecting payment-routing selections
- Structured postal address: not supported by this REST resource
- Verification: independent exact BIC/branch query after creation
- Recovery: delete only if unused and Oracle permits; otherwise use a separately reviewed
correction
- Documentation: Oracle Financials 26C
(https://docs.oracle.com/en/cloud/saas/financials/26c/farfa/op-cashbankbranches-post.html)
- Plan ID: 22222222-2222-4222-8222-222222222222
- Digest: 2222222222222222222222222222222222222222222222222222222222222222
- Expires: 2026-08-19 13:21:00 CEST
Reply approve to execute this exact branch plan.
─ Worked for 1m 59s ───────────────────────────────────────────────────────────────────────────
› approve
• Approval received for branch plan 22222222-2222-4222-8222-222222222222. I’m executing it
exactly once, then verifying by BIC and branch number without retrying the write.
───────────────────────────────────────────────────────────────────────────────────────────────
• The branch POST returned HTTP 201 with BranchPartyId 300000000000002. As with the bank
response, Oracle emitted an unreliable /1 self-link, so I’m verifying independently through
exact BIC and clearing-number collection lookups.
───────────────────────────────────────────────────────────────────────────────────────────────
• Both independent lookups returned exactly one matching branch with the expected parent bank,
number, BIC, and name. I’m removing the temporary request files now; no reusable recipe or
execution history will be retained unless you explicitly opt in.
• Edited 2 files (+0 -28)
└ library/local/requests/create-example-bank-branch-demo1.json (+0 -15)
1 -{
2 - "schema_version": "2.0",
3 - "operation_id": "financials.cash-bank-branches.create",
4 - "expected_effect": "state-changing",
5 - "headers": {
6 - "REST-Framework-Version": "4"
7 - },
8 - "body": {
9 - "CountryName": "Switzerland",
10 - "BankName": "Example Bank",
11 - "BankBranchName": "Zürich - Musterstrasse 1",
12 - "BranchNumber": "99999-0000",
13 - "EFTSWIFTCode": "EXAMCHZZ"
14 - }
15 -}
└ library/local/requests/create-example-bank-demo1.json (+0 -13)
1 -{
2 - "schema_version": "2.0",
3 - "operation_id": "financials.cash-banks.create",
4 - "expected_effect": "state-changing",
5 - "headers": {
6 - "REST-Framework-Version": "4"
7 - },
8 - "body": {
9 - "CountryName": "Switzerland",
10 - "BankName": "Example Bank",
11 - "BankNumber": "99999"
12 - }
13 -}
───────────────────────────────────────────────────────────────────────────────────────────────
• Example Bank is created and verified on demo1:
- Bank ID: 300000000000001
- Bank code: 99999
- Branch ID: 300000000000002
- Branch: Zürich - Musterstrasse 1
- Branch number: 99999-0000
- BIC/SWIFT: EXAMCHZZ
- Country: Switzerland
Exact BIC and branch-number lookups each returned one matching record. No tracked Git files
changed.
The structured postal address remains unset because Oracle’s bank REST resource does not
support it; only the branch name contains the supplied address. Oracle requires a separate
UI/Import Management step for structured addresses.
Save this use case and its execution history to the local library?
How it works
You always know what happens next.
1Ask
It uses current Oracle documentation and reads only what your question needs.
2Get the answer
You see the useful result in plain language.
3Review
Before a change, you see the old value, new value, date, impact, recovery, and exact request.
4Approve
Nothing runs until you approve that exact plan in a later message.
5Change once
It sends the approved update once. It never retries an uncertain result.
6Check the result
It reads the result back from Oracle and reports what completed, failed, or never ran.
Saving a recipe or redacted history is always optional. Nothing is retained until the owner says yes.
Across Oracle
One LLM conversation. All of Oracle.
The same ask, review, and approve flow works across documented Oracle APIs.
People
Workers, addresses, assignments, accounts, and other documented HCM records.
Finance
Invoices, holds, expenses, attachments, and other Financials operations.
Approvals
BPM task searches, exact reads, actions, and reassignment.
Identity
Documented SCIM lookups and carefully governed lifecycle changes.
Jobs
ESS submissions and status checks without guessing what happened.
Reports
BI Publisher parameters, report runs, and bounded output.
If an operation is not in the current checked catalogue, AI Administrator does not invent it.
For serious administration
Serious changes come with clear warnings.
If a change could affect identities, bank details, historical records, many people, or customer communications, AI Administrator explains the impact, what it can verify, and how to recover before you approve.
Your Oracle credentials never go to the model.
Plans, approvals, safety rules, licence checks, and the Oracle connection stay on your machine. Only the question and selected answer follow the model path you choose.
Included with Fusion Toolkit
Try it with your Oracle environment.
CLI, SQL Studio, and AI Administrator. Free for 30 days. No card. No obligations.