Connector guide
Connect Oracle Database safely
Least-privilege Oracle access with verified encrypted transport
1. Create a dedicated schema reader
Create a dedicated account with CREATE SESSION and explicit SELECT grants only on approved views. Do not grant DBA, broad catalog roles, or ANY privileges.
2. Restrict network and authentication
- Use TCPS with server distinguished-name verification.
- Use an Oracle wallet or approved private connectivity for enterprise deployments.
- Restrict listener access to Maya's egress boundary.
3. Expose only approved data
- Expose curated views or synonyms only when their targets are governed.
- Never grant SELECT ANY TABLE or dictionary access.
- Remove regulated columns at the view layer.
4. Verify before connecting
- Review effective roles and system privileges.
- Confirm the account cannot execute DDL or DML.
- Test approved schema-qualified reads only.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.