# The mashup

> GAMMA-Ray v0.0.2 (draft). The graph that joins the instruments: provisions, indicators and questions, how far they compress, which facts move the most instruments, and the outliers that would not compress.
> Page: https://gamma-ray.sgit.ai/mashup/ · Source: content/mashup/index.md


## The number

279 provisions in 8 instruments come down to 69 indicators and 21 questions. 209 provisions (75%) are reached. 70 are not, and are listed below.

*Figure. The compression in four bars; the numbers are in the text.*

## The graph

*Figure. The mashup as a graph (questions, indicators, provisions). The same data: /data/questions.json, /data/indicators.json, /data/provisions.json.*

## How the instruments connect

Two instruments are connected when one indicator cites both. 22 pairs of instruments are connected this way.

*Figure. The instruments as a ring joined by shared indicators.*

*Figure. How many indicators each pair of instruments shares; the same counts are in /data/summary.json.*

The ten strongest connections:

| Instruments | Indicators they share |
|---|---|
| Microsoft and OWASP | 14 |
| Microsoft and NIST AI RMF | 14 |
| NIST AI RMF and OWASP | 13 |
| AAGMM and OWASP | 13 |
| AAGMM and Salesforce | 12 |
| EU AI Act and NIST AI RMF | 11 |
| Microsoft and Salesforce | 10 |
| AAGMM and NIST AI RMF | 10 |
| AAGMM and Microsoft | 9 |
| NIST AI RMF and Salesforce | 8 |

## One answer, many needles

Each cell is the number of provisions of that instrument that one question reaches.

*Figure. Questions by instruments; the questions page lists every citation.*

28 of the 69 indicators are asked for by three or more instruments. These are the facts asked for by four or more:

| Indicator | Tier | Instruments it moves |
|---|---|---|
| Agents and use cases are classed by risk | Declared | 6: AAGMM, OWASP, NIST AI RMF, EU AI Act, Salesforce, Microsoft |
| High-impact actions need a person's approval | Public | 6: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft |
| A governance policy for agents is published | Public | 5: OWASP, Microsoft, NIST AI RMF, AAGMM, Salesforce |
| It is monitored in operation | Declared | 5: Microsoft, NIST AI RMF, EU AI Act, AAGMM, Salesforce |
| Several agents coordinate inside the organisation | Public | 4: OWASP, Salesforce, Microsoft, AAGMM |
| The organisation keeps a registry of its agents | Declared | 4: OWASP, NIST AI RMF, AAGMM, Salesforce |
| There are data quality rules for what it reads | Declared | 4: EAAMM, Salesforce, AAGMM, Microsoft |
| The people who work with it are trained | Declared | 4: NIST AI RMF, EU AI Act, EAAMM, Microsoft |
| It is improved on a regular cycle | Declared | 4: AAGMM, Microsoft, NIST AI RMF, OWASP |
| The organisation's risk management covers agents | Declared | 4: EAAMM, EU AI Act, NIST AI RMF, Microsoft |

## Every scan against every question

*Figure. Every scan against every question.*

## What would not compress

A provision is an outlier when no question reaches it. Some are about the organisation and not the agent (culture, communities, investment). Some are specific to one instrument. They are kept, because the list of what only one instrument asks is a finding.

### Salesforce: 3 of 34

- Level 0, how companies can advance from Level 0 to Level 1: Focus not only on time savings but also on value and personalized customer experiences.
- Level 1, how to advance from Level 1 to Level 2: For customer-facing agents, ensure brand consistency is reflected.
- Level 4, how to maximize value: Explore new business models enabled by agent collaboration

### OWASP: 1 of 35

- AT0 Shadow AI: No organisational awareness or approval. Users self-adopting AI tools outside governance.

### Microsoft: 43 of 88

- 100: Initial, AI strategy and experience: Pilots are sporadic or tactical
- 100: Initial, AI strategy and experience: Limited AI or business alignment
- 100: Initial, AI strategy and experience: No Responsible AI (RAI) awareness
- 100: Initial, AI governance and security: No operational model
- 100: Initial, AI governance and security: No support model
- 100: Initial, Technology and data: Fragmented tooling
- 100: Initial, Technology and data: No technical architecture or reference architectures
- 100: Initial, Technology and data: Limited infrastructure (outstation agents for adoption at scale)
- 100: Initial, Organization and culture: No champions or communities
- 200: Repeatable, AI strategy and experience: Limited leadership alignment
- 200: Repeatable, Business strategy: Incremental improvements
- 200: Repeatable, Business strategy: No end-to-end process redesign
- 200: Repeatable, Business strategy: Early value story forming;
- 200: Repeatable, Technology and data: Basic environment structure
- 200: Repeatable, Technology and data: Limited awareness across early adopters
- 200: Repeatable, Organization and culture: Limited awareness across early adopters
- 300: Defined, AI strategy and experience: Cross-functional planning and goals
- 300: Defined, AI governance and security: Standardized architecture
- 300: Defined, AI governance and security: AI practices
- 300: Defined, AI governance and security: Reusable components
- 300: Defined, Technology and data: Active makers/communities
- 300: Defined, Technology and data: Defined enablement models and systems
- 300: Defined, Technology and data: Contextual knowledge base with enablement assets
- 300: Defined, Organization and culture: Regular knowledge sharing and enablement assets
- 400: Capable, AI strategy and experience: Cross-department alignment
- 400: Capable, AI strategy and experience: RAI guiding design
- 400: Capable, Business strategy: Domain redesign post agent optimization
- 400: Capable, Business strategy: Strong transformation assessment
- 400: Capable, Technology and data: Scalable enterprise foundations
- 400: Capable, Technology and data: Automated deployment and quality assurance guidance
- 400: Capable, Technology and data: Performance tuning
- 400: Capable, Organization and culture: Champions embedded in organization
- 400: Capable, Organization and culture: Shared acceleration models
- 400: Capable, Organization and culture: Shared center engagement and incentives
- 400: Capable, Organization and culture: Culture of optimization
- 500: Efficient, AI strategy and experience: AI-first culture
- 500: Efficient, Business strategy: AI-enabled new innovations and investment
- 500: Efficient, Business strategy: RAI is part of enterprise culture
- 500: Efficient, Technology and data: Self-improving community
- 500: Efficient, Technology and data: Emerging innovation agents
- 500: Efficient, Technology and data: Predictive agents used to guide reliability and performance
- 500: Efficient, Organization and culture: Self-sustaining community, emerging innovation agents
- 500: Efficient, Organization and culture: Continuous learning culture with clear incentives

### NIST AI RMF: 22 of 72

- GOVERN 3.1: Decision-makings related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).
- GOVERN 4.1: Organizational policies, and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize negative impacts.
- GOVERN 4.2: Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly.
- MANAGE 1.4: Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.
- MANAGE 2.1: Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.
- MANAGE 2.2: Mechanisms are in place and applied to sustain the value of deployed AI systems.
- MAP 1.2: Inter-disciplinary AI actors, competencies, skills and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.
- MAP 1.6: System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors.  Design decisions take socio-technical implications into account to address AI risks.
- MAP 2.3: Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
- MAP 3.2: Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented.
- MAP 5.2: Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.
- MEASURE 1.2: Appropriateness of AI metrics and effectiveness of existing controls is regularly assessed and updated including reports of errors and impacts on affected communities.
- MEASURE 2.2: Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.
- MEASURE 2.8: Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 2.9: The AI model is explained, validated, and documented, and  AI system output is interpreted within its context – as identified in the MAP function – and to inform responsible use and governance.
- MEASURE 2.11: Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- MEASURE 2.12: Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.
- MEASURE 2.13: Effectiveness of the employed TEVV metrics and processes in the MEASURE function are evaluated and documented.
- MEASURE 3.1: Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.
- MEASURE 3.2: Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.
- MEASURE 4.1: Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.
- MEASURE 4.2: Measurement results regarding AI system trustworthiness in deployment context(s) and across AI lifecycle are informed by input from domain experts and other relevant AI actors to validate whether the system is performing consistently as intended. Results are documented.

### EU AI Act: 1 of 11

- Article 27: Fundamental rights impact assessment for high-risk AI systems

## How this was made, and its limits

- Each instrument was read at its source and cut into provisions by a script or by hand; the texts are in [provisions.json](../data/provisions.json).
- The indicators and their links were written by one reader, an AI agent, in one pass on 10 November 2026. No second reader has checked them. Expect them to move.
- "Reached" means that an indicator cites the provision, sometimes only in part. It does not mean that a yes to the question satisfies the provision.
- Microsoft's 88 items are the bullets of its quick reference as the page served them; some sit in a different column from the one their wording suggests.