# Coverage

> GAMMA-Ray v0.0.2 (draft). How much of each instrument GAMMA-Ray can answer at each tier: from public evidence, from the operator's answers, and from the operator's evidence.
> Page: https://gamma-ray.sgit.ai/coverage/ · Source: content/coverage/index.md


GAMMA-Ray uses a share of each instrument, and says which. A provision counts at the lowest tier at which one of its indicators can be answered.

*Figure. Coverage of each instrument by tier; the table below has the numbers.*

| Instrument | Rates | Provisions | Public | Declared | Evidenced | Not reached |
|---|---|---|---|---|---|---|
| Salesforce | the agent's use case | 34 | 22 (65%) | 9 (26%) | 0 (0%) | 3 (9%) |
| EAAMM | the agent's use case | 12 | 8 (67%) | 4 (33%) | 0 (0%) | 0 (0%) |
| OWASP | the deployed agent (tier) and the organisation (governance) | 35 | 17 (49%) | 13 (37%) | 4 (11%) | 1 (3%) |
| MCP authorization | the agent's published endpoint | 15 | 8 (53%) | 0 (0%) | 7 (47%) | 0 (0%) |
| AAGMM | the organisation | 12 | 6 (50%) | 6 (50%) | 0 (0%) | 0 (0%) |
| Microsoft | the organisation | 88 | 22 (25%) | 22 (25%) | 1 (1%) | 43 (49%) |
| NIST AI RMF | the organisation and the AI system | 72 | 19 (26%) | 31 (43%) | 0 (0%) | 22 (31%) |
| EU AI Act | the AI system, its provider and its deployer | 11 | 6 (55%) | 4 (36%) | 0 (0%) | 1 (9%) |

## What it says

- The instruments that rate **the agent** (the protocol's authorisation rules, EAAMM's levels, OWASP's tiers, Salesforce's levels) are the ones that can be read from outside.
- The instruments that rate **the organisation** (Microsoft, NIST, most of AAGMM) need the operator's word or evidence. That is what the Declared and Evidenced tiers add.
- These shares are of the provisions as we cut them. Cutting an instrument differently changes the numbers.

Earlier counts, made by hand before the mapping existed, are in the [research notes](../research/outside-coverage-first-pass.md); the figures on this page are computed from the data and replace them.