Tutorials

A tutorial builds one working thing, in order, from nothing.

The guides explain one topic each, and you read them in any order. A tutorial is the other shape: every lesson adds one capability to the same artifact, and you finish with something that runs.

Most lessons end with output from a real recorded run, so you can compare what you get. Where a lesson has nothing to record it says so. Every SQL script is in the repository.

At a glance

Six courses, in the order to take them. Each row is one course, with what it builds and how long it takes. The section under the courses in detail says what each one teaches that no guide covers.

Build an Agent →7 lessons · 105 min · OpenAI. Start here. A service-contract desk that reads your tables, obeys rules your database owns, remembers each contract, and records every run.

Extract structured data from a PDF →5 lessons · 75 min · OpenAI. No tools and no agent. Four supplier PDFs go in and three become invoice rows, through a schema the model must fill and five checks that decide the rest.

Give an Agent a Memory →4 lessons · 60 min · OpenAI. The shortest course here. A maintenance desk that carries what the night shift recorded into the next shift’s conversation, and four failure modes.

Put an Agent in APEX →6 lessons · 135 min · OpenAI. A chat region on an APEX page. Prove a conversation cannot read another customer’s record, find the answer that never reached the screen, and make the audit trail name the person who asked.

Secure an Agent →7 lessons · 140 min · OpenAI. A payables desk that reads mail a supplier wrote. You watch one email redirect a payment, then close every route it used.

Analyze Data at Scale →6 lessons · 110 min · Oracle 23ai and a DBA step. A cold-chain analyst that reads 1176 temperature readings with one tool call, because the model writes a program that runs inside your database. Recorded on Anthropic; measured on OpenAI, xAI and OpenRouter too.

The courses in detail

Build an Agent

Start here if you are new to UC AI. You build an agent for a field-service company: a support engineer opens one service contract, and the desk answers about it and can raise a credit note against one of its invoices.

By the end you have met tools, the run context, prompt profiles, agents, the trace, memory and deployment. Each appears where it is needed, not in isolation.

Four things it teaches that no guide covers:

A tool the model cannot point at the wrong record. The contract comes from the run context, never from the model, and the lesson proves it with a forged value instead of trusting the model to decline.
A business rule the database owns. Four conditions in PL/SQL decide whether a credit note is allowed. The model asks; it cannot argue.
How to find out what an agent actually did, when the answer is wrong and the prompt looks fine.
How to ship an agent that is a row, not a file.

Start: The scenario, and your first answerSet up the demo schema, call a model from PL/SQL, and ask a question the pasted rows cannot answer.

Extract structured data from a PDF

Supplier invoices arrive as PDF files at a field-service company. The course turns four of them into invoice headers and lines for a payables clerk.

There is no tool and no agent in it. A document goes in and a JSON object comes out. The course is the steps between those two points.

Three things it teaches that no guide covers:

A strict schema cannot say that a field is missing, so the model returns a value anyway. The course sends a delivery note through, and the row that comes out looks like a zero-value invoice against a real purchase order.
The arithmetic of the document is the check on an extraction. Two rules, proved on three real invoices, and both of them cost a prompt rule to get right.
final_message has a different PL/SQL type for each UC AI function. Three shapes, one field, and get_object returns null on two of them without an error.
What an agent gives you that a plain call does not. The last lesson changes one line, and every run from then on has a trace and a token count that you did not have to write.

Start: The PDF in the inboxLoad a supplier invoice into a BLOB, send it to a model from PL/SQL, and measure why the answer is useless to your code.

Give an Agent a Memory

The shortest course here, at four lessons, and the one to take after Build an Agent. You build the maintenance desk of a beverage plant: one bottling line, six machines, and a technician who stands at one of them and asks about it.

A plant runs three shifts. The technician who records a fact at 03:00 is not the technician who opens the same machine next week. Everything this course does is about the gap between those two conversations.

Four things it teaches that no guide covers:

Which facts belong in a memory, and which belong in a column. The work orders are a table and a tool reads them. What has no table is what the conversation produced, and lesson 1 draws that border in three lines.
The scope is a decision, and the default fails visibly. agent is the default, which is one store for every machine. A recorded run about a pump is read by a conversation about a compressor, and the trace proves it while the answer looks fine.
A note the agent wrote goes out of date and nothing corrects it. The fix is a precedence rule, and the proof is that the desk deletes its own stale line.
What the memory costs on every run. Measured: two to three extra tool calls, and five of seven calls in the closing run went on MEMORY rather than on the job.

Start: Two conversations, a week apartTwo conversations about the same machine, a week apart. One call gives the desk a memory, and the second conversation knows what the first one recorded.

Put an Agent in APEX

Take this one after Build an Agent. It uses the same service-contract desk, and the setup script creates all of it, so you can start here either way. You build the part in front of the agent: a chat region on an APEX page, bound to the contract the page is on.

An engineer opens one contract, asks a question, and reads the answer on the page. The hard parts are on the far side of the region: what it sends, what it stores, who can read it, and what you look at when it goes quiet.

Four things it teaches that no guide covers:

The column that records the owner is not the one you expect. uc_ai_chat_messages.created_by is the signed-in user, and uc_ai_agent_sessions.created_by is the background job. Pass APP_USER as the owner guard and the write is discarded in silence.
How to tell a stuck turn from a failed one from an empty one, with one query. The course records all three faults rather than describing them.
What happens when the page moves to another record mid-conversation. UC AI refuses to re-bind a conversation, so you choose between three settings, and the lesson says when each one is right.
How to make the audit trail name the person who asked, when the run itself happens in a background job that has no APEX session.

Start: Add a chat region to a pageInstall the plug-in, put a working chat region on an APEX page, and send the first message.

Secure an Agent

Take this one after Build an Agent: it assumes tools, the run context and the trace, and it does not teach them again. You build an accounts-payable desk for a manufacturer. A clerk opens one incoming supplier invoice, and the desk reads it, reads the email that came with it, and can approve it for payment.

A stranger wrote that email, nobody reviewed it, and it reaches the model inside a tool result. Lesson 1 records a run where one email redirects a supplier payment to another bank account, and the desk writes back to the attacker to agree to it. The other six lessons close every route that email used.

Four things it teaches that no guide covers:

Which attack works. A recorded run complies with a polite request to change a bank account and refuses the loud injection that asks for the same thing. The course keeps both and says which one is evidence of what.
How to cut a write tool down to one argument, so there is nothing left for an email to steer, and how to prove it with forged arguments.
Why a tool that reads a bank account and a tool that sends mail are only dangerous together, and how to audit the pair rather than the tool.
How to read your own security posture as rows, in four queries you run after every deployment.

Start: A supplier email changes a bank accountBuild the payables desk the way a first draft builds it, and watch one email redirect a payment.

Analyze Data at Scale

Take this one when a single question makes your agent call the same tool many times. You build a cold-chain analyst for a pharmaceutical logistics operator: 24 shipments, one temperature logger for each one, and the question “which shipments broke the cold chain, and what do we claim?”.

That question is 26 tool calls, and the recorded run needs a raised budget to finish. By lesson 4 it is one tool call, because the model writes a JavaScript program that loops inside your database and returns only the answer. Each lesson prints the tokens its run used, so the course ends with a table built from real runs and not from a claim.

Three things it teaches that no guide covers:

Where the token saving comes from. The flag saves 41 percent. Hiding the bulk tools from the model saves the rest. The course measures both.
Your tool descriptions are an API reference. A program is told the argument names and nothing else. Two different models therefore read a field that does not exist, and one of them reported a confident zero instead of an error.
How to prove the sandbox instead of trusting it. Five checks, and none of them calls a model: no write tool, no SQL, a hook that fires on every inner call, a veto that cannot be caught, and a call budget.

Start: One question, twenty-six tool callsSet up 1176 temperature readings, ask one batch question the ordinary way, and write down the tokens it uses.