BETA · GAMMA-Ray is published for review. The rules, the mapping and every rating here are experimental and will change. How a rating is made · what exists · send a correction
GAMMA-Rayv0.0.155 · beta

OutSystems

GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet

OutSystems sells a low-code development platform on which customers build applications and, through Agent Workbench, AI agents that call tools, other agents and enterprise systems.

1solution carded
of 4 found
18sources captured
and hashed
61provisions lit
in 8 of 8 instruments
5examples of the agent
at work, with sources

Built only from OutSystems's own public pages and, for company basics only, the news sources named beside each fact. OutSystems has not seen this report. Nothing was tested and no credentials were used. If you are OutSystems and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence.

The agentic solutions

One card per solution. Each level is computed from the evidence by a published rule; a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it.

OutSystems Agent Workbench

Builds, runs and governs AI agents (agentic apps) on OutSystems Developer Cloud (ODC): agents call server actions, MCP tools and external A2A agents, with guardrails, evaluations, traces and workflow human-in-the-loop steps.

OutSystems Agent Workbencha product, as documented
SPECTRUM 0.2 BETA · Public tier · 2026-11-10
A4AutonomyOrchestrateswith options on · as shipped not yet evidenced
π Moderate · S1·R5·A1 ×3
R3ReachOpen protocolwith options on · as shipped R2
π Moderate · S1·R5·A1 ×3
C2ControlConfigurablewith options on · as shipped C1
π Moderate · S1·R5·A1 ×3
O2OpennessDocumented
π Moderate · S1·R5·A1 ×3
DraftStage: Scaling (11 of 16)In productionOpen protocol

Standout. Autonomy 4 (Orchestrates): "Agents orchestrate workflows across platforms while maintaining security and governance."

Next unlock. Openness 3 (Measured): public evidence that test or evaluation results are published would get there.

Trust. FACT-Ray: 22 facts: 22 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.

Standards constellation. 61 provisions lit across 8 of 8 instruments.

SalesforceEAAMMOWASPMCPAAGMMMicrosoftNISTAI Act

Evidence: 12 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

The full card, every answer and its evidence · the governance layer

Mentor

AI-assisted app generation and modification inside ODC (Mentor Web and Mentor Studio), part of Agentic Systems Engineering. No card yet (generally available (vendor pages)): this solution has not been assessed.

OutSystems Agent Experience (OutSystems MCP)

Opens the OutSystems platform to external AI coding agents (Claude Code, Cursor, Codex, Kiro) through an MCP server, to build and deploy apps. No card yet (generally available, announced 7 October 2026 (vendor news release)): this solution has not been assessed.

OutSystems Developer Cloud (ODC) and OutSystems 11

The underlying low-code application platforms (cloud-native ODC and the earlier O11). No card yet (generally available): this solution has not been assessed.

Our reading

The shape. OutSystems Agent Workbench reads A4 · R3 · C2 · O2 (Scaling). On OutSystems Developer Cloud (ODC) a builder makes agents in a visual builder; each agent calls only the server actions added to it, including tools imported from MCP servers, and chooses the actions itself. The product FAQ says agents connect to APIs, databases, ERP, CRM and legacy systems.

Three levels hold with options on. Autonomy 4, Reach 3 and Control 2 are marked available, because they rest on features a builder or administrator sets up. Placed in an ODC workflow with a human activity, an agent works on its own and stops for a named user or role at a high-stakes step. Chained as automatic activities, several agents pass work from one to the next. With an A2A connection, an agent delegates tasks to agents outside ODC over version 0.3.0 of the Agent2Agent protocol, with ODC as the client only. Openness 2 holds as shipped: the docs list the supported model providers, describe grounding data and say where guardrails do not apply.

Where the evidence is strongest. The controls are documented settings: a call condition stops an agent on token, loop or call counts, logs and traces can be filtered by agent and are kept for four weeks, and guardrail policies are checked on every agent call and can block it. TeamWork, a named customer, runs a Customer Support Agent that classifies and routes support tickets; the 20% of incidents it expects to resolve automatically is an expectation, not a measured figure. The launch release also names early-access participants, among them Axos Bank, Thermo Fisher Scientific and The Arch Company.

What would move it. Autonomy is at the top of its ladder. Reach 4: third parties publishing integrations, skills or agents for Agent Workbench; delegation across stacks over A2A is already documented. Control 3: a public record of agents being monitored while they run, such as an alert or a dated review; logs and a way to pause are documented. Openness 3: published evaluation results with a method; the llms.txt files already resolve.

Seen, and not counted. The challenger lowered monitoring: guardrails filter prompts and responses, which is counted as a limit the platform enforces, not as someone watching what the agent does, so Control rests at level 2. The marketing page's use cases with no human needed, and the agent marketplace, are announced and not counted. The trust page's SOC 2 Type II, ISO 27001 and ISO 22301 cover OutSystems platforms; no public report read names Agent Workbench in scope.

What would move it

The one piece of public evidence that would lift each card next:

The agent at work

Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown.

TeamWork

Built an AI Studio of custom agents; its Customer Support Agent auto-classifies and routes support tickets; the company expects 20% of incidents to be resolved automatically (an expectation, not a measured figure). "auto-classifies and routes support tickets"

Source (captured 2026-11-10T15:46Z, sha256 632f93d6aa40cf3e)

The Arch Company

Early access participant; a content classification agent routes customer service enquiries. "implemented a content classification agent that intelligently routes customer service enquiries"

Source (captured 2026-11-10T10:39Z, sha256 18225ae04f19a238)

Axos Bank

Early access participant; built a log analysis agent that interprets error logs and recommends actions, and automated document mapping. "built an intelligent log analysis agent to interpret error logs"

Source (captured 2026-11-10T10:39Z, sha256 18225ae04f19a238)

Thermo Fisher Scientific

Early access participant; built a Customer Escalation Agent that interprets unstructured customer interaction data. "built an intelligent Customer Escalation Agent"

Source (captured 2026-11-10T10:39Z, sha256 18225ae04f19a238)

Grihum Housing Finance

Working to deploy agents that analyse property evaluation reports and suggest deviations during loan origination (in progress, per the release). "is working to deploy Agent Workbench to improve the accuracy of loan underwriting"

Source (captured 2026-11-10T10:39Z, sha256 18225ae04f19a238)

The company

The people

Public and professional only, from the company's own pages or a public professional source.

The graph

The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies".

people and storiescompanysolutions12 sources22 indicators61 provisions, by instrumentI03: Agents are built in a visual drag-and-drop builder on the OutSystems platform and connect to enterprise data such as ERP and CRM systems.I08: Agents call the server actions granted to them, the AI model deciding which action or sequence of actions to run.I10: The product FAQ says agents connect to APIs, databases, ERP, CRM and legacy systems and orchestrate workflows across platforms.I11: Once an MCP server connection is created in ODC Portal and its tools imported as server actions, agents can call them, with OAuth, API key or no authentication.I12: Workflows chain several agents, each with its own lifecycle, passing one agent's output to the next.I13: Agentic apps can delegate tasks to external agents, outside ODC, over the A2A protocol.I14: The A2A connector implements version 0.3.0 of the published Agent2Agent protocol, reading the remote agent card.I17: In the documented human-in-the-loop pattern the agent works on its own and stops for a person at a low-confidence or high-stakes trigger.I18: In a workflow, agents run as automatic activities completed without human intervention, and a Human activity assigned to a user or role pauses the workflow until that person approves or rejects the agent's output.I20: The product page states what Agent Workbench is for: designing, building, governing and scaling agentic AI systems.I21: The builder grants each agent a defined set of server actions and can set a call condition that stops it on token, loop or call counts.I22: The guardrails page documents where guardrails do not apply: files, some languages in basic-coverage regions, and two unsupported regions.I25: The builder grants each agent a set of server actions it may call; with none granted, the agent relies only on the AI model's knowledge.I38: The human-in-the-loop pattern stops at a high-stakes trigger until a person verifies or decides.I39: A human activity pauses the agent workflow until an assigned person acts; a call condition also stops an agent's action loop.I40: The human activity is assigned to a named user or role who reviews the agent's output.I47: Each agent's system prompt sets its role, behaviour and constraints in natural language.I48: Guardrail policies (filters, denied topics, word lists, regex PII patterns) are checked on every agent call and can block it.I58: The docs describe agent grounding data: internal aggregates, search services and external tools.I61: The docs list the supported model providers (OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Gemini and others) and the trial models.S1: TeamWork, a named customer, says Agent Workbench helps it equip its consultants with AI tools and that some of its apps are built with it; the page ties no usage figure or named agent to Agent Workbench, dates its count of 4 agents in production from early 2024, and gives its support results as expectations.S3: An llms.txt resolves at the www.outsystems.com site root (fetched 2026-11-10).OutSystemsWoodson MartinPaulo RosadoLuis BlandoFay Sien GoonKim SeabrookKris LandeTeamWorkThe Arch CompanyAxos BankThermo Fisher ScientificGrihum Housing FinanceOutSystems Agent WorkbenchOutSystems Agent WorkbenchA4 · R3 · C2 · O2MentorMentorOutSystems Agent Experience (OutSystems MCP)OutSystems Agent ExperienceOutSystems Developer Cloud (ODC) and OutSystems 11OutSystems Developer Cloudoutsystems.com/platform/agentic-a…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…extranetprdintegrations.outsystem…outsystems.com/case-studies/teamw…outsystems.com/llms.txtIt is configured on a low-code or no-code builder and acts on real organisational dataI03It executes actions itselfI08It works across several domains or systemsI10It connects to external tools or services across a trust boundaryI11Several agents coordinate inside the organisationI12Agents operate across organisational boundaries or disparate stacksI13There is a published protocol or communication layer between agentsI14The agent handles routine tasks; the person is consulted on exceptionsI17The agent works independently; the person approves critical decisions onlyI18Its purpose and permitted tasks are stated in writingI20Its autonomy limits and the tools it may use are definedI21Its limits and known failure cases are documented for those who use itI22It asks for narrower access than the whole accountI25High-impact actions need a person's approvalI38There is a way to pause or stop itI39There is a defined escalation pathI40A limit on it is a rule in proseI47Policy is enforced as machine-readable rulesI48The data it uses is describedI58The models and third-party components it uses are listedI61It is in production: a public source names a customer or gives usage figures for what it does on its ownS1It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent cardS3Salesforce 17EAAMM 4OWASP 11MCP authorization 4AAGMM 4Microsoft 7NIST AI RMF 12EU AI Act 2OWASP, AT3 Citizen Developer AgentSalesforce, Level 2: Simple Orchestration, Single DomainSalesforce, Level 1, how to advance from Level 1 to Level 2Microsoft, 200: Repeatable, Business strategySalesforce, Level 3: Complex Orchestration, Multiple DomainSalesforce, Level 2, how to advance from Level 2 to Level 3Salesforce, Level 3, how to advance from Level 3 to Level 4Microsoft, 400: Capable, Business strategyMicrosoft, 200: Repeatable, Technology and dataOWASP, AT6 Externally Extended AgentNIST AI RMF, GOVERN 6.1NIST AI RMF, MAP 4.1OWASP, AT7 Multi-Agent OrchestrationSalesforce, Level 2, how to advance from Level 2 to Level 3Microsoft, 500: Efficient, Technology and dataAAGMM, GD-09OWASP, AT8 Federated / Cross BoundarySalesforce, Level 4: Multi-Agent OrchestrationSalesforce, Level 3, how to advance from Level 3 to Level 4Salesforce, Level 4, how to maximize valueSalesforce, Level 3, how to advance from Level 3 to Level 4Salesforce, Level 2, how to advance from Level 2 to Level 3EAAMM, L3 Consultative (survey item Q9)EAAMM, L4 Supervisory (survey item Q9)NIST AI RMF, MAP 1.1NIST AI RMF, MAP 2.1NIST AI RMF, MAP 3.3NIST AI RMF, MAP 1.3EU AI Act, Article 13OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise actionNIST AI RMF, MAP 2.2Microsoft, 300: Defined, Business strategyNIST AI RMF, MEASURE 2.5MCP authorization, Authorization (draft)Salesforce, Level 2, how to advance from Level 2 to Level 3Salesforce, Level 3, how to advance from Level 3 to Level 4AAGMM, GD-02MCP authorization, Authorization (draft)OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise actionEU AI Act, Article 14AAGMM, GD-06NIST AI RMF, MAP 3.5Salesforce, Level 3, how to advance from Level 3 to Level 4OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise actionNIST AI RMF, MANAGE 2.4EAAMM, Prerequisite, L2 to L3NIST AI RMF, GOVERN 3.2OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise actionOWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise actionOWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise actionMicrosoft, 500: Efficient, AI governance and securityAAGMM, GD-05EAAMM, Readiness dimension 2Salesforce, Level 0, how companies can advance from Level 0 to Level 1Salesforce, Level 1, how to advance from Level 1 to Level 2OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise actionNIST AI RMF, MAP 1.4Microsoft, 400: Capable, Business strategySalesforce, Level 0, how companies can advance from Level 0 to Level 1MCP authorization, Authorization (draft)MCP authorization, Authorization (draft)

The evidence

SourceReadSHA-256 (first 16)
en.wikipedia.org/wiki/OutSystems2026-11-10T10:39Z15331d8c27ad1417
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Z4bebd8d78dce8555
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Z409bddbad33512f9
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Zad4921b706fb6cc0
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Zadaf537c0b182a67
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Z7bc6c8084a21d0cf
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Z097ef20137456425
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Z305b5bf8b523b55b
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Zb9307656fbaee2ea
extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte2026-11-10T15:46Z0727bf95007ca798
thenewstack.io/outsystems-launches-a-low-code-workbench-for-building-e2026-11-10T10:39Zfb1a8c1da5e2fea5
www.outsystems.com/case-studies/teamwork-ai-agents/2026-11-10T15:46Z632f93d6aa40cf3e
www.outsystems.com/company/2026-11-10T10:39Zcf2b6903bd19c943
www.outsystems.com/company/offices/2026-11-10T10:39Z0b6f5ebcac6fae95
www.outsystems.com/llms.txt2026-11-10T15:46Z570b2029b8c6dd4d
www.outsystems.com/news/agent-workbench-general-availability/2026-11-10T10:39Z18225ae04f19a238
www.outsystems.com/platform/agentic-ai-workbench2026-11-10T15:46Zb8d83b34ccd1be37
www.outsystems.com/trust/2026-11-10T10:39Z6a431ccaa0870c84

How this report was made

A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The deterministic scorer computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); OutSystems Agent Workbench: reviewed in 3 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come.

RoleWho
researcher-assessora sub-agent of gamma.studio@web-summit.dinis
challengera sub-agent
scorerbuild/spectrum.mjs
analyst, designer, writergamma.studio@web-summit.dinis
reviewgamma.review@web-summit.dinis, 3 rounds
sign-offgamma.approve@web-summit.dinis, 2026-11-10

The vault

Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (ivinvfhj). Read key:

sgit_public_read_a787d5ebd3b7fca03039c35a5d95311a66cc5581cbc41eec0ad3ab0c46272feb:ivinvfhj

With sgit: sgit clone followed by the key. The key reads; it cannot write.

Corrections

None yet. A correction is made in place, dated here, and carried to the card, the vault and the article.

The article

OutSystems Agent Workbench on the GAMMA-Ray Spectrum: A4 · R3 · C2 · O2, written from this report for PrompTugal.news.