Update to Oracle Analytics

{
  "description": "Manage Oracle Analytics Cloud catalog permissions through the OAC MCP tools. Use when a user asks to grant, revoke, or otherwise change access to a catalog item, or when a permission-management workflow needs to locate the exact target item before updating its ACL. Treat ACL updates as security-sensitive, production-impacting catalog mutations. Require explicit approval immediately before execution, never infer users, groups, roles, inheritance, or permission semantics, and do not claim that current permissions were inspected unless a connected tool actually returned them.",
  "included_files": [],
  "name": "oac-governance-permissions",
  "skill_md_contents": "---\nname: oac-governance-permissions\ndescription: Manage Oracle Analytics Cloud catalog permissions through the OAC MCP tools. Use when a user asks to grant, revoke, or otherwise change access to a catalog item, or when a permission-management workflow needs to locate the exact target item before updating its ACL. Treat ACL updates as security-sensitive, production-impacting catalog mutations. Require explicit approval immediately before execution, never infer users, groups, roles, inheritance, or permission semantics, and do not claim that current permissions were inspected unless a connected tool actually returned them.\n---\n\n# Oracle Analytics Cloud Governance and Permissions\n\n## Configured instance\n\nUse only the Oracle Analytics MCP connection attached to the selected configured instance. Ground requests in that instance's live tools, metadata, identifiers, and permissions. Do not fall back to the template example URL, a remembered demo account or catalog path, or another instance's connection. If no instance is configured, explain that a workspace administrator must configure one before this workflow can run.\n\nUse this skill for catalog access-control changes. Use the runtime-exposed MCP schema as the authoritative source for supported ACL arguments, principal identifiers, permission values, and response fields.\n\n## Workflow\n\n1. Identify the exact catalog target.\n   - If the target is not already established by an unambiguous identifier or current tool output, use `oracle_analytics-search_catalog` to locate it.\n   - Do not infer a target from a similar name when multiple matches exist.\n\n2. Establish the requested permission change.\n   - Preserve the principal, permission, scope, and intended action exactly as established by the user and supported tool schema.\n   - Do not invent or infer user IDs, group IDs, application roles, inheritance behavior, permission names, or ACL merge/replace semantics.\n\n3. State the exact intended change.\n   - Make clear which catalog item will be changed and what access change will be attempted.\n   - If the live tool semantics indicate a replace-versus-merge distinction, surface that distinction before approval.\n\n4. Require explicit approval.\n   - `oracle_analytics-update_catalog_acl` modifies Oracle Analytics Cloud and requires `userApproved: true` or an explicit approval flow.\n   - Obtain approval immediately before invoking the ACL update.\n   - Do not interpret a general request to review or manage permissions as approval for a specific ACL mutation.\n\n5. Execute the update.\n   - Invoke `oracle_analytics-update_catalog_acl` only with values supported by the live schema and grounded in user intent or prior tool output.\n   - Do not broaden access beyond what the user requested.\n\n6. Report the outcome.\n   - Do not claim success until the tool confirms it.\n   - Report resulting permissions or status only when returned by the tool.\n   - Preserve errors or uncertainty rather than filling gaps.\n\n## MCP tools\n\n- `oracle_analytics-search_catalog`: Locate the target catalog item when necessary. Experimental and read-only.\n- `oracle_analytics-update_catalog_acl`: Update catalog permissions. Experimental; modifies OAC; approval required.\n\n## Important limitation\n\nThe documented OAC MCP tool set does not list a dedicated read-only ACL inspection tool. Do not claim that this skill can enumerate or audit existing permissions unless the active runtime exposes additional supported functionality or the ACL update tool returns that information. If a user asks only \"who has access?\", state the limitation instead of fabricating a permission view.\n\n## Security rules\n\n- Prefer the smallest change that exactly matches the user's request.\n- Never grant broader access as a convenience or workaround.\n- Do not make assumptions about inherited permissions or effective access.\n- Do not convert names to identities unless a connected tool explicitly resolves them.\n- Do not invent MCP parameters. Follow the live runtime schema.\n- The OAC MCP integration is in Preview, and both catalog search and ACL update are experimental tools.\n\n## Example requests\n\n- \"Give the Finance Analysts group access to this workbook.\"\n- \"Remove access for this role from the Planning folder.\"\n- \"Change the permissions on the Q4 forecast workbook.\"\n"
}