Coverage
GAMMA-Ray uses a share of each instrument, and says which. A provision counts at the lowest tier at which one of its indicators can be answered.
| Instrument | Rates | Provisions | Public | Declared | Evidenced | Not reached |
|---|---|---|---|---|---|---|
| Salesforce | the agent's use case | 34 | 22 (65%) | 9 (26%) | 0 (0%) | 3 (9%) |
| EAAMM | the agent's use case | 12 | 8 (67%) | 4 (33%) | 0 (0%) | 0 (0%) |
| OWASP | the deployed agent (tier) and the organisation (governance) | 35 | 17 (49%) | 13 (37%) | 4 (11%) | 1 (3%) |
| MCP authorization | the agent's published endpoint | 15 | 8 (53%) | 0 (0%) | 7 (47%) | 0 (0%) |
| AAGMM | the organisation | 12 | 6 (50%) | 6 (50%) | 0 (0%) | 0 (0%) |
| Microsoft | the organisation | 88 | 22 (25%) | 22 (25%) | 1 (1%) | 43 (49%) |
| NIST AI RMF | the organisation and the AI system | 72 | 19 (26%) | 31 (43%) | 0 (0%) | 22 (31%) |
| EU AI Act | the AI system, its provider and its deployer | 11 | 6 (55%) | 4 (36%) | 0 (0%) | 1 (9%) |
What it says
- The instruments that rate the agent (the protocol's authorisation rules, EAAMM's levels, OWASP's tiers, Salesforce's levels) are the ones that can be read from outside.
- The instruments that rate the organisation (Microsoft, NIST, most of AAGMM) need the operator's word or evidence. That is what the Declared and Evidenced tiers add.
- These shares are of the provisions as we cut them. Cutting an instrument differently changes the numbers.
Earlier counts, made by hand before the mapping existed, are in the research notes; the figures on this page are computed from the data and replace them.