Oracle Cloud Infrastructure Documentation

Permissions for Data and Context Management

This topic describes the IAM permissions required for context and content management in OCI Generative AI. It outlines the access needed for users to create and manage files, vector stores, and vector store connectors.

For OCI Generative AI Vector Store Connectors

  • Create a dynamic group for vector store connectors.
  • Grant the dynamic group permission to read Object Storage resources in the specified compartment.
  1. Create a dynamic group for applications and deployments in the tenancy with the following matching rule:
    all {resource.type='generativeaivectorconnector'}
  2. To restrict the vector store connectors to a specific compartment, update the previous condition to: 
    all {resource.type='generativeaivectorconnector',
resource.compartment.id='<your-compartment-OCID>'}
  3. Create a policy to grant the dynamic group permission to read Object Storage resources such as buckets.
    Allow dynamic-group <dynamic-group-name> 
to read object-family in compartment <your-compartment-name>'}