A single reporting connection into your BRM database converts a restricted-use grant into a full-use claim priced at $47,500 per processor, and roughly 1 in 3 enterprises running an ASFU-licensed application already has one.
Oracle Communications applications such as BRM, OSM, and UIM ship with Oracle Database and WebLogic entitlements that are technically identical to full use but legally confined to the named application. The moment a data warehouse feed, a DBA reporting script, or a second application touches that schema, Oracle re-prices the estate at full-use list, where a two-socket 64-core node alone reaches 32 processor licenses and $1.52 million before options. The finding decides whether you spend the next quarter on a technical inventory or on a back-license negotiation.
Prepared by Redress Compliance · August 21, 2026 · Oracle advisory. Communications audit and renewal engagements, 2024 to 2026.
Executive summary
The restricted-use database under a Communications application is technically indistinguishable from full use, which is precisely why it gets breached: nothing in the binary stops a DBA from pointing Tableau at the BRM schema.
Oracle's own position is that an Application Specific Full Use grant permits identical features but confines them legally to the named application, so enforcement is contractual and retroactive rather than technical and preventive.
The remediation price is full-use list, not the discounted rate you paid for the bundle: Oracle Database Enterprise Edition at $47,500 per processor against restricted grants that were sold at 30 to 70 percent off, and embedded grants at roughly 10 percent of list.
That gap, not the headline breach, is where the money sits, because a $200,000 embedded entitlement can be re-valued past $2 million on the same hardware.
Options are the second exposure layer and are often larger than the database itself: a fully optioned Enterprise Edition processor reaches $122,000 list with $26,840 annual support, 2.6 times the base license.
Carrier stacks routinely enable Partitioning ($11,500), Advanced Compression ($11,500), RAC ($23,000), and Diagnostics Pack ($7,500) for performance reasons that no one checked against the restricted grant.
The middleware layer carries the same trap with documented Oracle wording: Active GridLink for RAC data sources is an entitlement only under WebLogic Suite at $45,000 per processor, and WebLogic SIP Server ships in every WebLogic edition but requires a separate OCCAS license to use.
An OSM deployment connecting to a RAC cluster on anything less than WebLogic Suite is out of scope by clause, not by interpretation.
What the restricted grant actually says, and the exact acts that void it
The grant you hold under an Oracle Communications order is not a database license in the sense your DBA team understands the term.
It is a use right scoped to a named application, and the scope language sits in the ordering document, not in the Master Agreement most procurement teams filed and forgot.
Four distinct grant types circulate through Communications paperwork: Application Specific Full Use (ASFU), restricted use, limited use, and embedded software license (ESL). They are not synonyms, and Oracle's own advisers treat restricted use and limited use as materially different constructs.
The practical consequence is that two BRM environments bought eighteen months apart can carry different scope wording, different voiding triggers, and different remediation math.
Read the ordering document line by line against the schedule in your Oracle Communications BSS and OSS licensing position, because the discount you received is the single best clue to which grant you actually hold. Deep discounting is not generosity.
It is the price of a narrowed scope, and Oracle prices the reversal at full-use list.
| Grant type | Typical discount off Database EE list | Scope wording, in substance | What voids it | Remediation price |
|---|---|---|---|---|
| ASFU | 30 to 70 percent off, with some sources reporting 40 to 70 percent | Use only in conjunction with the named ISV or Oracle application | Any query, report, or data load not originating from the named application | Full-use list, $47,500 per Processor for Database EE |
| Restricted use (bundled with an application license) | Frequently 80 to 90 percent below list, sometimes no separate line item | Confined to a specific function, for example ODI restricted to scenarios where the named product is source or destination | Using the component outside the enumerated function set | Full-use list for the underlying component |
| Limited use | Varies; not equivalent to restricted use despite common conflation | Capped by a stated metric, user count, or module boundary rather than by application association | Exceeding the stated cap, even inside the named application | Full-use list plus back-support on the gap period |
| Embedded (ESL) | Approximately 10 percent of Oracle list | Embedded in a packaged solution, no direct end-user access to the database | End-user or third-party tool access to the schema | Full-use list, and the ESL grant does not survive |
The table cannot show the thing that makes this expensive: the shipped binaries are feature-identical to full use. Oracle does not ship a restricted build. There is no license key, no feature flag, no installer prompt, no runtime warning.
Partitioning, Advanced Compression, Diagnostics Pack, and Multitenant all install and run exactly as they would under a full-use grant, which means your DBA can turn on $11,500 or $17,500 per processor of options in ten minutes without any technical control objecting.
Because no technical control exists, breach is not discovered by your team. It is discovered by an Oracle audit script that enumerates DBA_FEATURE_USAGE_STATISTICS, active sessions by program name, and database links.
By that point the usage history is written to the repository and the conversation is retrospective, which is precisely the position Oracle wants to negotiate from.
Where the breach happens in a real BRM, OSM, and UIM stack
In twenty-five years of unpicking these estates, the breach almost never arrives as a deliberate decision. It arrives as four recurring engineering conveniences.
First, and most common in carrier stacks, the BRM database becomes a source for something downstream: a data warehouse, a revenue assurance platform, a fraud analytics engine, or a regulatory reporting mart.
The ETL agent authenticates directly against the BRM schema, and at that moment the database is serving a consumer other than BRM. Oracle's position is that this is unlicensed use, remedied by a full-use purchase at list. Second, DBA operational and reporting scripts.
Capacity trending, chargeback reporting, and custom health dashboards written against the BRM schema are all out-of-scope usage even though they touch no business data, and they are trivially visible in session history. Third, consolidation.
Somebody puts a second application, often a small internal one, on the restricted-licensed server or into a spare PDB, and the entire host is now arguably full-use territory.
Fourth, integration sprawl: Oracle's own AIA licensing position states that adding an application beyond the original integration scope requires full-use licenses, so the fourth system bolted onto an OSM or UIM orchestration flow converts the grant for everything upstream of it.
The tools that surface in audit scripts are predictable.
Oracle looks for BI and reporting connections (OBIEE, Tableau, Power BI, Cognos), ETL agents (Informatica, ODI outside its restricted scenario wording, Talend, custom PL/SQL extract jobs), monitoring collectors (SolarWinds, Nagios, Zabbix, third-party APM agents querying V$ views).
And non-production copies where test data subsets have been cloned from BRM into a shared QA instance that also hosts other applications.
Each of these leaves a program name, a service name, or a database link that maps cleanly to a non-BRM consumer. The single most valuable exercise before any audit notice arrives is a two-week connection inventory: every account, every service, every link, tied to a named application owner.
If the connection cannot be traced back to BRM, OSM, or UIM as defined in your ordering document, treat it as exposure and price it against the subscriber metric and processor footprint you already hold before Oracle prices it for you.
Stop overpaying for Oracle Database 23ai options
Oracle Database 23ai bundles options you may never deploy. The buyer side guide to edition right sizing, option pruning, and AI Vector Search licensing.
Get the white paper →The middleware layer: WebLogic, Coherence, and the GridLink bridge
Buyers who spend three weeks reconciling database processor counts under BRM routinely spend fifteen minutes on the middleware, and that is where the second-largest back-license claim lives.
Oracle's published wording does the work for the auditor. WebLogic Server Basic is a constrained edition, delivered so the application runs, not so you can build on it.
Unrestricted Enterprise Edition function arrives only when Internet Application Server or, more commonly today, WebLogic Suite is licensed independently.
The clauses beneath that are more specific than most procurement teams expect.
Active GridLink for RAC data sources are an entitlement available only as part of licensing WebLogic Suite ($45,000 per processor) or Exalogic Elastic Cloud Software.
So the standard carrier pattern of pointing OSM at a RAC cluster through GridLink for fast connection failover converts a bundled runtime into a Suite obligation across every processor in the domain.
WebLogic SIP Server ships inside all editions of WebLogic Server, but Oracle states plainly that you must license Oracle Communications Converged Application Server to hold usage rights, the clearest example of shipped-but-not-entitled in the Communications portfolio.
And where BPEL Process Manager is in play, the included Coherence Enterprise grant is restricted to clustering, portable object format, local caching, and internal SOA usage: a Coherence cache serving an external channel or a second application is a full Coherence purchase.
| Component | Bundled entitlement under Communications apps | What voids it | Full list per processor |
|---|---|---|---|
| WebLogic Server Basic | Runtime for the named application only | Deploying custom or third-party apps to the domain | SE $10,000 / EE $25,000 |
| WebLogic Suite | Not included | Active GridLink for RAC, advanced clustering | $45,000 |
| Coherence Enterprise (via BPEL) | Clustering, POF, local caching, internal SOA use | External or second-application caching | $11,500 (Grid Edition $25,000) |
| WebLogic SIP Server | Ships in all WLS editions, no usage right | Any production SIP use without OCCAS | OCCAS licensed separately |
| SOA Suite | Not included | Composite orchestration outside the app | $57,500 |
Why Oracle prices the remedy at list, and why that is a negotiation not a bill
The restricted-use breach is, by margin, the most profitable sales motion Oracle runs in the Communications install base, and understanding why is the first step to defusing it. A conventional deal starts with a customer who wants something and a discount schedule that reflects competitive pressure.
A restricted-use finding starts with a customer who has already deployed, already depends on the workload, and has no alternative supplier for a database that a live billing platform is bound to.
Oracle's stated remedy is a Full Use purchase at list: $47,500 per processor for Enterprise Edition, plus whatever options the estate has enabled, plus 22 percent annual support on the net. The finding is not a bill. It is an opening position dressed as arithmetic.
The mechanics of who gets audited are worth stating precisely, because they explain the asymmetry. The ASFU order carries the customer's company name, Customer Support Identifier, and processor count.
Oracle therefore audits the carrier, not the application division or partner that packaged the grant.
Whatever the internal Oracle politics between the Communications business unit and LMS, the license entity on the paper is you.
And the remediation quote lands on your desk with no obligation on anyone else's part to explain why the deployment guide recommended the very reporting connection that voided the grant.
Then there is the leverage the re-pricing rule creates. A breach is almost always narrow in fact: one ODBC connection from a data warehouse, one DBA script pulling operational metrics, one second application reading the BRM schema. The re-price is not narrow.
It is per processor across the entire node, and on a two-socket 64-core Intel server, the 0.5 core factor produces 32 processor licenses, or $1.52 million at EE list before a single option. One connection, seven figures.
That ratio is the reason the motion exists, and it is also the reason the number is negotiable: nobody inside Oracle genuinely believes the commercial harm from one reporting feed equals thirty-two full-use licenses.
Support is where a one-time finding turns into an annuity. At 22 percent of net license fees, a converted full-use position feeds the Communications support line forever, and it does so on a base that never shrinks unless you terminate licenses and accept repricing on the remainder.
When you model the settlement, model ten years of support, not the license line. That total is the number Oracle's account team is compensated against, and it is the number that gives you room to trade.
Now turn it. Benchmark evidence across the install base shows what full use actually clears at, not what it lists at. Tier 2 transactions in the $500,000 to $5 million band settle at $19,000 to $28,500 per processor, 40 to 60 percent off.
Tier 3 transactions above $5 million settle at $11,800 to $19,000, 60 to 75 percent off, with an observed floor of $8,500 per processor, 82 percent off, on a strategic deal above $25 million. A remediation quote issued at $47,500 is not a price.
It is the top of a distribution in which your peers are transacting three to five times lower, and the only reason it arrives at list is that Oracle assumes you do not know the distribution exists.
Your leverage is three things: time, scope, and the renewal. Time, because a finding with no contractual deadline can be worked through technical remediation while the fiscal quarter closes in on the account team, not on you.
Scope, because every processor you can remove from the claim (decommission the offending connection, isolate the workload, restate the affected node count) shrinks the base before any discount is applied.
And the renewal, because Oracle wants the multi-year Communications subscription and support stream far more than it wants a contested back-license line that ends in your BRM subscriber metric being renegotiated under duress.
Bundle the remediation into the renewal and price it as one commercial event.
The table Oracle shows you has one column: list price times processors.
The table it does not show you has three more: the actual clearing price for your deal tier, the number of processors that survive technical remediation.
And the ten-year support tail attached to whatever you sign. Insisting the settlement be priced off Tier 2 or Tier 3 benchmarks rather than list is not aggressive, it is standard, and account teams concede it routinely once they understand you have the comparables.
The practical posture, then, is not denial and not capitulation.
It is to accept that a technical finding exists, dispute the valuation method rather than the fact, remediate aggressively to shrink the processor base before pricing begins, and refuse to close the license line separately from the renewal.
In twenty-five years, I have not seen a restricted-use claim settle at list where the customer held those four positions together.
The paperwork chain nobody in procurement has read
The restricted grant you are relying on does not live in one document.
It lives in a chain: Oracle Partner Network membership that the application vendor or Oracle line of business must join and maintain for the full duration of the agreement, the Master Distribution Agreement, the Application Specific Full Use Program Distribution addendum.
And a separate registration form that defines each "application package" by name.
Miss one link and the entitlement you thought you bought is undocumented. In practice, almost nobody on the buy side has seen more than the last one, and often not even that. What matters legally is narrower still: the ordering document line item is the only authoritative scope statement.
Not the sales deck. Not the installation guide. Not the Communications deployment architecture diagram that shows a database in the middle of it.
I have watched Oracle Communications bundles reference program packages by name (Oracle Database Enterprise Edition, WebLogic Suite, Coherence) without restating the restriction anywhere in the ordering document body, which cuts both ways: it is an ambiguity you can argue.
But only if you have the paper.
Terminology also matters, because "restricted use" and "limited use" are not the same grant in Oracle's vocabulary, and the Communications price lists mix both.
Demand the following in writing, from Oracle Contracts (not your account rep) and from the reseller of record if the deal came through a partner: the signed MDA and ASFU addendum, every registration form covering your BRM, OSM, and UIM packages.
And the full ordering document set with line-item program names and quantities.
Cross-check against the Communications BSS/OSS licensing structures before you concede anything.
Evidence base: what recurring patterns look like across carrier estates
Roughly one third of enterprises running an ASFU-licensed application already have at least one connection that breaches the restriction.
Intel core factor 0.5 means 64 cores equals 32 processors at $47,500 EE list, before any option or support.
| Line item | Per-processor list | Where it shows up in a carrier stack |
|---|---|---|
| Database Enterprise Edition | $47,500 | The BRM, OSM, or UIM schema itself once re-priced full use |
| Partitioning | $11,500 | BRM event and rated-usage tables, near universal |
| Advanced Compression | $11,500 | CDR and event archive retention |
| Real Application Clusters | $23,000 | Billing and order capture high availability |
| Active Data Guard | $11,500 | Standby used for reporting, which itself voids the restriction |
| Diagnostics Pack | $7,500 | AWR and ASH, switched on by DBAs by default |
| Advanced Security | $15,000 | TDE on subscriber PII |
| WebLogic Suite | $45,000 | OSM and UIM containers, Active GridLink dependency |
| Coherence Enterprise Edition | $11,500 | OSM caching tier |
| Support | 22% of net, annually | Permanent once the position converts |
The single most common audit finding is not overdeployment of cores. It is usage outside the named application: a reporting tool, an integration, or a second application touching the schema, re-valued at full use list.
A fully optioned processor reaches $122,000 list with $26,840 annual support, roughly 2.6 times the base database line, so the option stack drives the claim more than the base license does.
Prices here reflect the Technology Global Price List effective April 16, 2026, with Oracle's posted PDF carrying a later effective date of August 3, 2026; verify every figure against the current published list before you model anything, because Oracle reprices without notice.
In my experience across carrier estates, the same three connections recur: a nightly extract into the enterprise data warehouse, a DBA-authored operational reporting script, and a fraud or analytics platform reading rated events directly.
Cross-reference the BRM subscriber metric exposure separately, because the two claims compound.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
Your first five moves
- Pull the ordering documents before you touch a server, week one. Have the contracts owner retrieve every Oracle Communications ordering document, the Master Distribution Agreement addendum, and each application package registration form, then classify every Database and WebLogic line as Full Use, ASFU, Restricted Use, Limited Use, or Embedded, because those five grant types carry different remedies and, as covered in our Oracle Communications BSS/OSS licensing guide, they are routinely mislabeled in internal asset registers.
- Run the connection inventory yourself, weeks two to four. Give the DBA lead a fixed brief: enumerate every session, service name, database link, ETL job, JDBC pool, and reporting account touching the BRM, OSM, and UIM schemas, and record who owns each one, because Oracle's audit script will produce the same list and you want it first.
- Kill or license the options that were switched on for performance, weeks three to six. Partitioning, Advanced Compression, Diagnostics Pack, and In-Memory get enabled by engineers with no entitlement check, and at $11,500 to $23,000 per processor at list each, one unchecked feature on a 32 processor node is a seven figure conversation.
- If a breach exists, control the disclosure and scope it to the connection, not the node. Legal and licensing should agree a single written position that names the specific out of scope feed and the processors that feed touches, since Oracle's opening move is always to re-price the entire node or cluster at Full Use list.
- Price remediation against benchmark bands, not the price list. Anchor on Tier 2 clearing at $19,000 to $28,500 per processor and Tier 3 at $11,800 to $19,000, and treat the 22% support stream on any converted position as the real cost, because it is permanent and it compounds.
The sequencing is the leverage. Every one of these moves is cheap and reversible while the finding is internal, and every one becomes an admission once Oracle has opened a formal review.
In our negotiation experience, buyers who complete steps one and two before contact settle at conversion pricing, and buyers who react to an Oracle letter settle near list. The technical inventory is not a compliance exercise, it is the pricing evidence you will use to cap the claim.
Frequently asked questions
Is the Oracle Database under BRM a full license or a restricted one?
Unless your ordering document says full use, it is restricted. Oracle Communications applications commonly bundle an Application Specific Full Use or embedded grant that permits Oracle Database only in support of the named application.
The binaries are identical to full use, so you cannot tell from the installation, only from the ordering document line item.
What specifically voids a restricted-use Oracle Database license?
Any use outside the named application.
In practice that means connecting a BI or reporting tool, running ETL feeds to a data warehouse, hosting a second application's schema on the same instance, DBA scripts unrelated to the application, or extending an integration flow to a system the original grant did not cover.
Oracle's audit scripts detect these through session and connection data, and roughly 1 in 3 ASFU estates already carry at least one.
How much does Oracle charge when the restriction is breached?
Oracle prices the remedy at full-use list, which is $47,500 per processor for Database Enterprise Edition, plus any options in use and 22 percent annual support on the net fee.
A restricted grant sold at 30 to 70 percent off, or an embedded grant at roughly 10 percent of list, gets re-valued at the undiscounted rate, which is where the exposure multiplies.
Does the restriction apply to Oracle Database options like Partitioning and RAC?
Yes, and options are frequently the larger exposure. A fully optioned Enterprise Edition processor lists at $122,000 with $26,840 annual support, 2.6 times the base license.
Partitioning and Advanced Compression at $11,500 each, RAC at $23,000, and Diagnostics Pack at $7,500 are routinely enabled by DBAs for performance without anyone checking whether the restricted grant covers them.
Does the same restricted-use logic apply to WebLogic under OSM and UIM?
It does, and Oracle's own documentation is explicit. WebLogic Server Basic is a constrained edition when Internet Application Server is licensed independently, and unrestricted WebLogic Enterprise Edition arrives only with WebLogic Suite at $45,000 per processor.
Active GridLink for RAC data sources is a WebLogic Suite or Exalogic entitlement only, so an OSM deployment hitting a RAC cluster through GridLink on a lesser edition is out of scope by clause.
Why does Oracle audit the carrier rather than the application vendor?
Because the ASFU order carries your company name, your Customer Support Identifier, and your processor count. The distribution paperwork sits between Oracle and the partner, but the license obligation and the audit clause attach to you.
That is why procurement teams who assume the vendor absorbed the compliance risk find themselves receiving the audit notice.
Can I negotiate a restricted-use breach down from list price?
Yes, and you should never treat the first claim as a bill.
Benchmark evidence shows Tier 2 deals of $500,000 to $5 million clearing at $19,000 to $28,500 per processor (40 to 60 percent off list) and Tier 3 deals above $5 million at $11,800 to $19,000 (60 to 75 percent off), with an observed floor of $8,500 on a strategic deal.
Tie any remediation to the Communications renewal timeline, where your leverage is highest.
