Ask whether your shop is “AI-ready,” and you will get a slide about PeopleTools 8.63.
Ask which LLM is approved, which record groups may leave the tenancy, who owns the prompt log, and who can flip MCP on in production — and you will get a pause.
That pause stopped being a future-state workshop on July 29. Sasank Vemana shipped PeopleTools 8.63 on OCI with three AI surfaces in writing: Natural Language Search Service, Model Context Protocol (MCP) server support, and Application Designer AI Assist. Mike Krajicek said the quiet part on camera: Oracle is not handing you a finished assistant. You supply the model, the subscription, and the security review.
🔗 Oracle releases PeopleTools 8.63 on OCI (Oracle) https://blogs.oracle.com/peoplesoft/peopletools-863-generally-available
🔗 What’s New in PeopleTools 8.63 (PeopleSoft Career) https://blog.peoplesoftcareer.com/whats-new-in-peopletools-8-63/
“Preserving PeopleSoft security and user context” is the marketing line. It is not a data-classification policy, a retention rule, or an audit trail of what the agent touched. Here are five questions that turn the shrug into a go/no-go.
1. Which data classes may leave the building — in writing?
Not “we follow least privilege.” The list: employee SSN and bank data, candidate PII, supplier TIN and withholding names, GL detail, payroll results, student records if you run Campus. For each class: allowed in prompts, allowed in search-index answers, allowed as MCP tool output, or never.
If the answer is “MCP respects row-level security,” you answered a different question. RLS decides who can see a row inside PeopleSoft. It does not decide whether that row may be serialized into a model provider’s context window, a vendor prompt log, or a developer’s IDE plugin.
Write the matrix. Date it. Name an owner. Without that file, every AI demo is an unapproved egress path.
2. Which LLM is approved — and where does the prompt log live?
8.63 is pluggable on purpose. App Designer AI Assist and the chat/search components wait on the model you wire up. SMACT’s planning guide says the quiet part: establish LLM selection and data governance before enabling AI Assist or exposing PeopleSoft data through MCP.
🔗 Oracle PeopleTools 8.63: AI, Security, and Upgrade Planning Guide (SMACT Works) https://www.smactworks.com/insights/blogs/2026/08/peopletools-8-63-guide.html
For the approved model, answer in one page: vendor, region, retention, whether training uses your prompts, DPA status, and who can read the logs. If two developers are already pointing Cline or Aider at a personal key, that is not a pilot. That is shadow IT with PeopleCode in the payload.
My read: “Bring your own LLM” is not freedom until procurement and InfoSec finish the same sentence.
3. What is the blast radius if the agent is wrong — or prompt-injected?
Separate read from write. Natural-language search that returns secured results is a different risk class from an MCP tool that can post a voucher, change direct deposit, or update a supplier TIN.
For every MCP tool or magic-button package you plan to expose: is it read-only, does it mutate, and what compensating control sits in front of the mutation (dual control, workflow, TOTP step-up)? 8.63’s TOTP API exists specifically so you can demand a second factor at a sensitive event — direct deposit, SSN lookup — not only at sign-on. Use it.
Also name the failure mode: hallucinated PeopleCode merged to production, an agent that summarizes performance comments into a channel it should not see, a tool description that tricks the model into calling a broader API. If you cannot describe the failure, you cannot monitor for it.
4. Who can enable the feature — and how do you prove what it touched?
Treat AI surfaces like Integration Broker nodes, not like a browser extension.
Inventory, in writing: which environments have MCP enabled, which App Designer clients have AI Assist configured, which magic buttons are live on which pages, which service accounts the agent uses, and which roles can change that config. Export the config. Put it in the same change record you would use for a new IB routing.
Then define the audit artifact before go-live: timestamp, calling identity, tool or prompt, objects touched, success/fail. “We can check WebLogic logs” is not an audit trail. If you cannot answer who asked what about which employee on which day, you are not ready for production HR or Payroll context.
5. What is the smallest non-production pilot that earns a production decision?
Not a town hall. A charter with a start date, an end date, a dataset that is scrubbed or classified as allowed, success metrics, and a written go/no-go.
Good first pilots: App Designer AI Assist against a non-prod project that contains no employee PII; Natural Language Search against a scrubbed index; one read-only MCP tool that returns a non-sensitive lookup. Bad first pilots: production Payroll Q&A, supplier TIN cleanup via an agent, or “let the intern wire Claude to HCM.”
Write the kill criteria in the same document: unexpected data in a prompt log, a mutation without workflow, a model region change, or a missing audit row. If the pilot cannot fail, it is a demo.
Do this once, then make it an artifact
Five artifacts, not five opinions: the data-class matrix, the approved-LLM one-pager, the read-vs-write blast-radius list, the enablement/audit inventory, and a dated pilot charter with kill criteria.
Re-run the inventory every time someone asks to “just turn on MCP.” The diff is the control. “We’re AI ready because we upgraded to 8.63” is not.
Monday’s Digest covered why this landed now: 8.63 GA on OCI put NL Search, MCP, and AI Assist in your upgrade path; Oracle and practitioners both said you supply the model and the security review; August CSPU is at Rev 4 with PeopleTools 8.61–8.63 still listed; Sep 15 CSPU is nine days out.
Next Thursday: 5 ways to make Integration Broker boring again.
🌐 Join the Community
Subscribe to PeopleSoft Cloud — practitioner posts every Thursday, the Modern ERP Digest every Monday.
✅ Concrete actions you can run this week, not advice ✅ Sources cited, costs stated honestly ✅ Free, always