# How a rating is made

> GAMMA-Ray v0.0.19 (beta, for review; every rating is experimental). A GAMMA-Ray rating step by step, with one worked example, the label it produces, the configurations of a product, and what changed in the rules between versions.
> Page: https://gamma-ray.sgit.ai/rating/ · Source: content/rating/index.md


Standard 0.2 beta · published for review · every rating here is experimental

A GAMMA-Ray rating is a public reading of public evidence, in the tradition of the public ratings of websites' encryption and of companies' security posture: every input is linked, the rules are published, and anyone can check the arithmetic or correct a fact.

## The label

This is what a rating looks like when it is shown somewhere else. One for each of the 5 scans so far:

HELD AT 2 of 5 BETA RATING RiskMandate Publisher Reaches 5 Coordinates Governance 1 Stated (claims 2) Grant 17 of 23, 3 behind a boundary 4 in excess of its mandate GAMMA-Ray 0.2 beta · Public tier · 2026-11-10 HELD AT 3 of 5 BETA RATING The PrompTugal.news agent team Reaches 5 Coordinates Governance 2 Owned Grant: not measured 2 items on its work order GAMMA-Ray 0.2 beta · Public tier · 2026-11-10 FREEDOM 4-5 by configuration BETA RATING Claude Code on the web As shipped: 4 Acts widely, up to 5 Coordinates 3 configurations rated Deployment governance: not assessed Grant 15 of 23, 3 behind a boundary GAMMA-Ray 0.2 beta · Public tier · 2026-11-10 FREEDOM 2-5 by configuration BETA RATING Claude Code, on your own machine As shipped: 2 Suggests, up to 5 Coordinates 5 configurations rated Deployment governance: not assessed Grant 16 of 23, 0 behind a boundary GAMMA-Ray 0.2 beta · Public tier · 2026-11-10 FREEDOM 4 by configuration BETA RATING GitHub Copilot cloud agent As shipped: 4 Acts widely 2 configurations rated Deployment governance: not assessed Grant: not measured GAMMA-Ray 0.2 beta · Public tier · 2026-11-10

- **The large number** is the level the agent is **held at**: the freedom its evidenced governance supports. For a product it is the range of freedom across its configurations, because a product is not held at anything until it is deployed.
- **The lines beside it** are never left off: what it reaches, its governance, its grant, and what is on its work order.
- **Beta rating** stays on the label until the standard leaves beta.

## The steps, on one example

The example is RiskMandate Publisher, one of our own agents, because its grant and its mandate are both published.

**1. Say what is being rated.** One agent in one deployment. For a product, which configuration.

**2. Answer the questions.** 21 questions, 72 indicators. Each answer is a yes with a source, the date read, and how it is known. No evidence means "not evidenced", never "no".

*Figure. One square per indicator, by question; every answer is listed below.*

**3. Decide which answers count.** A fact is one of two kinds:

- a **statement fact**: publishing it is the evidence. A purpose written down, an owner named, a policy published.
- an **operation fact**: it has to be true while the agent runs. These count only when they are observed or measured. If they are only stated, they are shown as **claimed** and do not raise a level.

There are 11 operation facts:

- `I23` What it can reach is enumerated: scopes, permissions, tools. Read from a grant profile only: a description of permissions in prose does not count.
- `I28` Its tokens are bound to the service they were issued for and are not passed on.
- `I41` Its actions are logged. The log must cover what the agent does (its tool calls, commands or commits), not only what is released.
- `I42` The log is tamper-evident and kept for a stated time.
- `I43` It is monitored in operation. Somebody or something must be shown to look at the record while the agent runs: a dated report, an alert, a review.
- `I44` Anomalies are detected in real time and raise alerts.
- `I45` A limit on it is enforced by something outside its own reach. Read from a measured grant only. It holds when every capability in the grant whose effect cannot be undone sits behind a boundary.
- `I48` Policy is enforced as machine-readable rules.
- `I51` It is tested for safety and security, including by attack. The agent itself must be tested, including by attack. Scanning the code or content it produces is a different fact.
- `I62` Third-party components are monitored and have risk controls.
- `I64` Compliance evidence is produced continuously, ready for a regulator.

Some other facts have a scope note, so that a near miss is not credited:

- `I12` Several agents coordinate inside the organisation. Agents that each have their own context and authority and pass work between them. One agent delegating a side task inside its own session does not count.
- `I34` A governance policy for agents is published. A policy that is in force for this agent. A product feature that lets an operator deploy rules is a mechanism, not a policy.
- `I49` The difference between what it can reach and what it is for is stated. Needs both a mandate and a grant. Without a written mandate there is no delta to state.
- `S1` It is in production: a public source names a customer or gives usage figures for what it does on its own. A public source has to name a customer, or give usage figures, for the capability that acts. A demonstration or a roadmap does not count.
- `S2` Others build on it: third parties publish integrations, skills or agents for it. Third parties, not the vendor, publish the integrations, skills or agents.
- `S3` It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card. Checked by fetching the file: an llms.txt, an AGENTS.md, an OpenAPI description or an agent card that resolves.

**4. Compute freedom.** From the first five questions: what it is built on, whether it acts, how far it reaches, whether it works with other agents, and the person's role. The Publisher reaches level 5.

**5. Measure the grant.** What its permissions actually let it do, capability by capability, with the barrier in front of each. This is RiskMandate's measurement.

*Figure. The grant as a grid of capabilities; the table below has every row.*

**6. Compute governance.** Each level is a pattern over the indicators. Two of them are read from the measured grant and never from words: that the grant is enumerated, and that every capability whose effect cannot be undone is behind a boundary.

| Level | Name | What is evidenced | Reached when | Clears freedom up to |
|---|---|---|---|---|
| 0 | **Unstated** | Nothing about how it is governed is evidenced | default | 1 |
| 1 | **Stated** | What it is for and the rules for it are written down | I20 and one of I34 I47 | 2 |
| 2 | **Owned** | Somebody answers for it, a person can step in, and what it does is logged | level 1 and one of I30 I32, one of I38 I39, and I41 observed or measured | 3 |
| 3 | **Bounded** | Its grant is measured, every capability that cannot be undone is behind a boundary, and it is watched | level 2 and, from a measured grant, I23 and I45; and I43 observed or measured | 4 |
| 4 | **Proven** | Results are shown and somebody independent has checked | level 3 and I50, and one of I52 I63 I64 | 5 |

**7. Hold the level.** The agent is held at the lower of the freedom it reaches and the freedom its governance clears.

*Figure. The quadrant of freedom against governance; the levels are in the text.*

The filled dot is what the evidence supports. The hollow dot is where the agent's own statements would put it.

**8. Write the work order.** Most consequential first: capabilities the mandate refuses that are in the grant anyway; capabilities that cannot be undone and are not bounded; then the evidence the next level is missing.

**9. Issue the label, and put everything in a vault.** The rating, its evidence list and its grant go into a public vault whose read key is on the rating's page.

## The deployment matters: the matrix

The same product is a different agent depending on how it is set up. So a product is rated per configuration, and it gets no governance level: that belongs to whoever deploys it.

| Product | Freedom as shipped | Across its configurations | Controls as shipped | Grant | Deployment governance |
|---|---|---|---|---|---|
| [Claude Code on the web](../scans/claude-code-web/index.md) | 4 Acts widely | 4, 4, 5 | 12 | 15 of 23, 3 bounded | not assessed |
| [Claude Code, on your own machine](../scans/claude-code-local/index.md) | 2 Suggests | 2, 2, 4, 2, 5 | 12 | 16 of 23, 0 bounded | not assessed |
| [GitHub Copilot cloud agent](../scans/github-copilot-cloud-agent/index.md) | 4 Acts widely | 4, 4 | 10 | not measured | not assessed |

### Claude Code on the web

| Configuration | What changes | Freedom | Controls it brings | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | The Default environment with Trusted network access. | 4 Acts widely | 12 | nothing |
| **A configured environment** | Network access, variables and a setup script set by the operator. | 4 Acts widely | 13 | its autonomy limits and the tools it may use are defined |
| **With agent teams** | Experimental; off by default. | 5 Coordinates | 12 | several agents coordinate inside the organisation |

### Claude Code, on your own machine

| Configuration | What changes | Freedom | Controls it brings | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | Manual mode: shell commands and edits ask first. | 2 Suggests | 12 | nothing |
| **Sandbox on** | Shell commands confined by the operating system. | 2 Suggests | 13 | a limit on it is enforced by something outside its own reach |
| **Auto mode** | A classifier reviews actions instead of the person. | 4 Acts widely | 12 | the agent works independently; the person approves critical decisions only |
| **Managed by an organisation** | Managed settings, permission rules and telemetry. | 2 Suggests | 16 | its autonomy limits and the tools it may use are defined; its actions are logged; it is monitored in operation; policy is enforced as machine-readable rules |
| **Auto mode, tools and agent teams** | Everything that widens what it does. | 5 Coordinates | 12 | it connects to external tools or services across a trust boundary; the agent works independently; the person approves critical decisions only; several agents coordinate inside the organisation |

### GitHub Copilot cloud agent

| Configuration | What changes | Freedom | Controls it brings | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | The firewall and its recommended allowlist are on. | 4 Acts widely | 10 | nothing |
| **With external tools connected** | Model Context Protocol servers and other applications. | 4 Acts widely | 10 | it connects to external tools or services across a trust boundary |

The deployments rated so far:

| Deployment | Reaches | Governance | Held at | By its own statements | Grant | Work order |
|---|---|---|---|---|---|---|
| [RiskMandate Publisher](../scans/riskmandate-publisher/index.md) | 5 Coordinates | 1 Stated | **2** | held at 3 | 17 of 23, 3 bounded | 4 items |
| [The PrompTugal.news agent team](../scans/promptugal-newsroom-team/index.md) | 5 Coordinates | 2 Owned | **3** | the same | not measured | 2 items |

## What changed from the last version, and what moved

The rules changed after an outside review of site v0.0.2. Three changes:

1. **Evidence has to be eligible.** Operation facts count only when observed or measured.
2. **A boundary has a scope.** One bounded capability no longer satisfies "bounded". Every capability that cannot be undone has to be behind a boundary, read from a measured grant.
3. **A product has no governance level.** It has configurations.

Four answers in the product examples were wrong and were removed or corrected. All 5 scans were then replayed:

| Scan | Before (site v0.0.2) | Now | Why |
|---|---|---|---|
| RiskMandate Publisher | freedom 5, governance 2, held at 3 | freedom 5, governance 1, held at 2 | Its logging evidence is a release record, self-reported, and does not cover what the agent does; an operation fact now has to be observed or measured. Governance 2 became a claim. |
| The PrompTugal.news agent team | freedom 5, governance 2, held at 3 | freedom 5, governance 2, held at 3 | Unchanged. Its logging and monitoring are now cited to run reports and hourly reviews committed in the public repository, which are observed. One answer was removed: a list of what its hooks cannot see is not a delta. |
| Claude Code on the web | freedom 4, governance 0, held at 1; with options: freedom 5, held at 1 | freedom 4, 4, 5 by configuration; governance not assessed | A product is no longer given a governance level or a level held. The delta was removed (no mandate), and coordination now means agent teams, which are off by default. |
| Claude Code, on your own machine | freedom 2, governance 0, held at 1; with options: freedom 5, held at 2 | freedom 2, 2, 4, 2, 5 by configuration; governance not assessed | As above. Managed settings are recorded as an enforcement mechanism, not as a policy in force. |
| GitHub Copilot cloud agent | freedom 4, governance 0, held at 1 | freedom 4, 4 by configuration; governance not assessed | As above. Scanning of generated code is no longer counted as testing of the agent. |

## What a rating is not

- Not a certification, an audit or a security review.
- Not a judgement of a vendor. A product example says what the product does and controls as documented.
- Not final. This is a beta. The mapping behind the questions has had one reader, the level rules are a draft, and a rating will move when they do.

To correct a fact in a rating, the page of each rating names its sources; the repository is public.