The brief

GAMMA-Ray was briefed by Dinis Cruz in speech, on 9 and 10 November 2026, during Web Summit Lisbon. These are his words as transcribed, cut to what decides the work, in the order he gave them. Where the source documents he started from were wrong, see the corrections.

Why (9 November 2026, after the opening night)

At the moment our website, PrompTugal, doesn't have a centre of gravity.

Take 5 standards that exist to map agents, and use them, because we have the graph technology, to map these companies and the companies we want to talk to. Then we put the interviews in context, and every interview that we do and everything we present is about this mashup.

First we need to create the GAMMA-Ray website and standard and mashup and connect the dots before we implement it.

Measurable, and with RiskMandate's lens (9 November)

I think it's very important that we operate in a level of strong certainty and less ambiguity, and also stuff that we can measure.

Your gamma ray level or score might actually be very different when you actually take into account the reality. So if you apply our concepts of reach and mandate, you realize that we might actually have a very different kind of level of risks.

Agents, from outside, and positive (10 November)

The focus here should be on agents. Take an agentic workflow as a company or as a team or as a system, and we need a way to map them and a way to show how mature they are. And this should be also positive.

We need to over-index on stuff that we can measure and stuff that we can calculate from the outside.

We can even say this takes 10% of this standard, 15% of that standard, 20% of that standard, because are the bits that we can map from the outside.

We'll make a vault per company, and that vault will contain all of the evidence, everything that we can collect, all the mappings and all the information, which will be public to start with, and then you can fork into a private angle.

GAMMA-Ray Public, and the tiers (10 November)

This is a gamma ray light or a gamma ray public, because we can have multiple gamma rays.

These other levels require access to company, requires more information, requires published information. So we can then say there's other levels that increase the coverage.

We end up with a list of questions, which are almost like a vendor risk assessment. It's almost like a due diligence report that is fundamentally primed to be to the public information.

Levels, and the abstraction layer (10 November)

We need to have levels, because the levels fundamentally should be very connected to the maturity, to levels of autonomy.

I like that the public version is the one we can measure, and then the values change based on the governance.

Let's say that we map 100 or 200 or 300 questions or more, we can then create a level above that links those. If I answer this question, I'm going to be answering this question from that standard, that question from that standard. And you end up with maybe 20 questions that can be answered.

Maybe there's a couple questions that you cannot consolidate, you cannot compress. But I bet there's lots of questions that match lots of standards. The wider the better.

The premise, the site and the score (10 November)

The more constrained a model is, the more controlled, the more governed a model is, the more we can trust it and the faster we can go.

Take into account the levels of almost agentic freedom and agentic governance that exists on them, and how much they are said to be controlled.

Make sure that the version is controlled by the CI pipeline and not by anything else.

We need to make these websites quite professional and quite mature, because ultimately we want to launch a standard.

Do a couple rounds on even our own risk mandate bots, our own PrompTugal bots, our own agency setups that we have been using for the Web Summit, see how they rate on this stuff. And on public examples of the most popular agentic workflows.

We will publish a score. That's what I want the team to work next, once we got this sorted out.

Remember to use sgit vaults to store any assessment value. These vaults are public because you're going to publish the vault key on the website.

RiskMandate is the lens, and products as examples (10 November, later)

Now, one thing I'd be confused is that you actually added risk mandate as one set of the questions that we're mapping. I was thinking of using risk mandate to actually measure the delta and the grant, because remember that a lot of these answers are theoretical answers, or some of them are, it depends on the context. So a lot of these answers, what you're measuring is the mandate and a lot of the behavior, but we still have a lot of the grants to calculate, which depends on what permissions they were given to.

We need to do a review of the example of multiple agentic solutions out there to start to see kind of how they look like here, as examples of this, big examples that there's quite a bit of data to support, but you need to create a vault for each one, and you need to put the data there.

Do another pass where you add up all the graphs and all the interconnections.

The rules given with the brief

Public sources only. No rating of a named company is published without its evidence and without the company having seen it. No contact details anywhere. Never push to the main branch. The name and the backronym stay as chosen.