Corrections to the brief
The brief began from two documents made with a research assistant (a selection of five standards, and a concept note). They were read against their sources on 9 and 10 November 2026. What was wrong, and what replaced it:
| The documents said | The source says | What GAMMA-Ray does |
|---|---|---|
| The evidence grades E0 to E5 (claim, marketing, press, primary source, artefact, verified) are adapted from AgentStripes | AgentStripes grades one released agent from its repository: could not be assessed, documentation, code or configuration, the developer's runs, a suite anyone can re-run, the assessor's sandbox or an independent review | The tiers (Public, Declared, Evidenced) are our own. A finer grading of evidence is still to design |
| The five standards align level by level, row by row | None of them maps itself to another | No level-to-level table. The bridge is the indicator, and every link is marked as our assertion |
| Ratings attach to deployments on all five | Microsoft, SEI and AAGMM rate the organisation; only Salesforce and EAAMM rate the use case | The agent is rated. Organisational provisions are reached at the Declared and Evidenced tiers |
| EAAMM is the autonomy standard | Its five levels are the user roles of Feng, McDonald and Zhang; EAAMM is one author's conference paper with a self-rated survey of 136 | EAAMM is cited as read; the source paper is still to read |
| AAGMM is the governance axis | It is one author's preprint, validated by simulation, licensed CC BY-NC-ND | Only its twelve domain names are cited. OWASP's report (CC BY-SA 4.0) carries the governance questions |
| Five standards | Nine instruments so far, among them NIST's AI Risk Management Framework, selected articles of the EU AI Act and the Model Context Protocol's authorisation rules | |
| "Non-invasive: no company cooperation required" | Kept. A rating made only from public sources may be published, labelled as beta and as not seen by its subject, and corrected when a fact is shown wrong (the operator's word of 10 November 2026) | |
| Site v0.0.2 gave products a governance level and a level held | A product has no owner, policy or mandate until it is deployed (an outside review, 10 November 2026) | A product is rated per configuration and has no governance level |
| Site v0.0.2 counted any stated answer towards a level, and one bounded capability as "bounded" | The same review | Operation facts count only when observed or measured; "bounded" means every capability that cannot be undone |
| Four answers in the product examples and one in our own were credited to the wrong indicator | The same review, and the gate | Removed or corrected; the replay is on the rating page |
| Draft 0.1 listed RiskMandate among the instruments it maps (our own first pass) | The operator: RiskMandate is what measures the grant and the delta | RiskMandate is the lens. It left the list of instruments; the grant is measured beside the questions |