# Report: OutSystems > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray beta report on OutSystems: OutSystems Agent Workbench A4 · R3 · C2 · O2; 61 provisions lit, 18 sources captured. > Page: https://gamma-ray.sgit.ai/reports/outsystems/ · Source: data/reports/outsystems.json GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet OutSystems sells a low-code development platform on which customers build applications and, through Agent Workbench, AI agents that call tools, other agents and enterprise systems. 1 solution carded of 4 found 18 sources captured and hashed 61 provisions lit in 8 of 8 instruments 5 examples of the agent at work, with sources Built only from OutSystems's own public pages and, for company basics only, the news sources named beside each fact. OutSystems has not seen this report. Nothing was tested and no credentials were used. If you are OutSystems and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence. ## The agentic solutions One card per solution. Each level is computed from the evidence by a [published rule](../../spectrum/evidence-map/index.md); a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it. ### OutSystems Agent Workbench Builds, runs and governs AI agents (agentic apps) on OutSystems Developer Cloud (ODC): agents call server actions, MCP tools and external A2A agents, with guardrails, evaluations, traces and workflow human-in-the-loop steps. OutSystems Agent Workbench a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 R3 Reach Open protocol with options on · as shipped R2 π Moderate · S1·R5·A1 ×3 C2 Control Configurable with options on · as shipped C1 π Moderate · S1·R5·A1 ×3 O2 Openness Documented π Moderate · S1·R5·A1 ×3 Draft Stage: Scaling (11 of 16) In production Open protocol Standout. Autonomy 4 (Orchestrates): "Agents orchestrate workflows across platforms while maintaining security and governance." Next unlock. Openness 3 (Measured): public evidence that test or evaluation results are published would get there. Trust. FACT-Ray : 22 facts: 22 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 61 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 12 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card [The full card, every answer and its evidence](../../spectrum/cards/outsystems-agent-workbench/index.md) · [the governance layer](../../scans/outsystems-agent-workbench/index.md) ### Mentor AI-assisted app generation and modification inside ODC (Mentor Web and Mentor Studio), part of Agentic Systems Engineering. *No card yet (generally available (vendor pages)): this solution has not been assessed.* ### OutSystems Agent Experience (OutSystems MCP) Opens the OutSystems platform to external AI coding agents (Claude Code, Cursor, Codex, Kiro) through an MCP server, to build and deploy apps. *No card yet (generally available, announced 7 October 2026 (vendor news release)): this solution has not been assessed.* ### OutSystems Developer Cloud (ODC) and OutSystems 11 The underlying low-code application platforms (cloud-native ODC and the earlier O11). *No card yet (generally available): this solution has not been assessed.* ## Our reading **The shape.** OutSystems Agent Workbench reads A4 · R3 · C2 · O2 (Scaling). On OutSystems Developer Cloud (ODC) a builder makes agents in a visual builder; each agent calls only the server actions added to it, including tools imported from MCP servers, and chooses the actions itself. The product FAQ says agents connect to APIs, databases, ERP, CRM and legacy systems. **Three levels hold with options on.** Autonomy 4, Reach 3 and Control 2 are marked available, because they rest on features a builder or administrator sets up. Placed in an ODC workflow with a human activity, an agent works on its own and stops for a named user or role at a high-stakes step. Chained as automatic activities, several agents pass work from one to the next. With an A2A connection, an agent delegates tasks to agents outside ODC over version 0.3.0 of the Agent2Agent protocol, with ODC as the client only. Openness 2 holds as shipped: the docs list the supported model providers, describe grounding data and say where guardrails do not apply. **Where the evidence is strongest.** The controls are documented settings: a call condition stops an agent on token, loop or call counts, logs and traces can be filtered by agent and are kept for four weeks, and guardrail policies are checked on every agent call and can block it. TeamWork, a named customer, runs a Customer Support Agent that classifies and routes support tickets; the 20% of incidents it expects to resolve automatically is an expectation, not a measured figure. The launch release also names early-access participants, among them Axos Bank, Thermo Fisher Scientific and The Arch Company. **What would move it.** Autonomy is at the top of its ladder. Reach 4: third parties publishing integrations, skills or agents for Agent Workbench; delegation across stacks over A2A is already documented. Control 3: a public record of agents being monitored while they run, such as an alert or a dated review; logs and a way to pause are documented. Openness 3: published evaluation results with a method; the llms.txt files already resolve. **Seen, and not counted.** The challenger lowered monitoring: guardrails filter prompts and responses, which is counted as a limit the platform enforces, not as someone watching what the agent does, so Control rests at level 2. The marketing page's use cases with no human needed, and the agent marketplace, are announced and not counted. The trust page's SOC 2 Type II, ISO 27001 and ISO 22301 cover OutSystems platforms; no public report read names Agent Workbench in scope. ## What would move it The one piece of public evidence that would lift each card next: - **OutSystems Agent Workbench**: Openness 3 (Measured). Public evidence that test or evaluation results are published. ## The agent at work Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown. ### TeamWork Built an AI Studio of custom agents; its Customer Support Agent auto-classifies and routes support tickets; the company expects 20% of incidents to be resolved automatically (an expectation, not a measured figure). "auto-classifies and routes support tickets" [Source](https://www.outsystems.com/case-studies/teamwork-ai-agents/) (captured 2026-11-10T15:46Z, sha256 `632f93d6aa40cf3e`) ### The Arch Company Early access participant; a content classification agent routes customer service enquiries. "implemented a content classification agent that intelligently routes customer service enquiries" [Source](https://www.outsystems.com/news/agent-workbench-general-availability/) (captured 2026-11-10T10:39Z, sha256 `18225ae04f19a238`) ### Axos Bank Early access participant; built a log analysis agent that interprets error logs and recommends actions, and automated document mapping. "built an intelligent log analysis agent to interpret error logs" [Source](https://www.outsystems.com/news/agent-workbench-general-availability/) (captured 2026-11-10T10:39Z, sha256 `18225ae04f19a238`) ### Thermo Fisher Scientific Early access participant; built a Customer Escalation Agent that interprets unstructured customer interaction data. "built an intelligent Customer Escalation Agent" [Source](https://www.outsystems.com/news/agent-workbench-general-availability/) (captured 2026-11-10T10:39Z, sha256 `18225ae04f19a238`) ### Grihum Housing Finance Working to deploy agents that analyse property evaluation reports and suggest deviations during loan origination (in progress, per the release). "is working to deploy Agent Workbench to improve the accuracy of loan underwriting" [Source](https://www.outsystems.com/news/agent-workbench-general-availability/) (captured 2026-11-10T10:39Z, sha256 `18225ae04f19a238`) ## The company - Founded in 2001 by Paulo Rosado in Lisbon, Portugal (Wikipedia). "OutSystems was founded in 2001 by Paulo Rosado in Lisbon, Portugal." [Source](https://en.wikipedia.org/wiki/OutSystems) (captured 2026-11-10T10:39Z, sha256 `15331d8c27ad1417`) - The company page dates the company to 2001. "Powering innovation since 2001" [Source](https://www.outsystems.com/company/) (captured 2026-11-10T10:39Z, sha256 `cf2b6903bd19c943`) - Woodson Martin was appointed CEO in 2025; Paulo Rosado became chairman (Wikipedia). "In 2025, OutSystems appointed Woodson Martin as CEO" [Source](https://en.wikipedia.org/wiki/OutSystems) (captured 2026-11-10T10:39Z, sha256 `15331d8c27ad1417`) - The offices page lists an office in Linda-a-Velha, Portugal. "Portugal - Linda-a-Velha" [Source](https://www.outsystems.com/company/offices/) (captured 2026-11-10T10:39Z, sha256 `0b6f5ebcac6fae95`) - Agent Workbench was announced generally available on 30 September 2025, at the OutSystems ONE conference. "OutSystems Announces General Availability of Agent Workbench" [Source](https://www.outsystems.com/news/agent-workbench-general-availability/) (captured 2026-11-10T10:39Z, sha256 `18225ae04f19a238`) - The trust page lists SOC 2 Type II, ISO 27001 and ISO 22301 among its audited controls and credentials. "SOC 2 Type II, ISO 27001, and ISO 22301" [Source](https://www.outsystems.com/trust/) (captured 2026-11-10T10:39Z, sha256 `6a431ccaa0870c84`) - The New Stack (technology news) reported the Agent Workbench launch on 30 September 2025. "OutSystems Launches a Low-Code Workbench for Building Enterprise AI Agents" [Source](https://thenewstack.io/outsystems-launches-a-low-code-workbench-for-building-enterprise-ai-agents/) (captured 2026-11-10T10:39Z, sha256 `fb1a8c1da5e2fea5`) ## The people Public and professional only, from the company's own pages or a public professional source. - **Woodson Martin**, Chief Executive Officer. [Source](https://www.outsystems.com/company/) - **Paulo Rosado**, Founder and Chairman of the Board. [Source](https://www.outsystems.com/company/) - **Luis Blando**, Chief Product and Technology Officer. [Source](https://www.outsystems.com/company/) - **Fay Sien Goon**, Chief Financial Officer. [Source](https://www.outsystems.com/company/) - **Kim Seabrook**, Chief Revenue Officer. [Source](https://www.outsystems.com/company/) - **Kris Lande**, Chief Marketing Officer. [Source](https://www.outsystems.com/company/) ## The graph The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies". people and stories company solutions 12 sources 22 indicators 61 provisions, by instrument I03: Agents are built in a visual drag-and-drop builder on the OutSystems platform and connect to enterprise data such as ERP and CRM systems. I08: Agents call the server actions granted to them, the AI model deciding which action or sequence of actions to run. I10: The product FAQ says agents connect to APIs, databases, ERP, CRM and legacy systems and orchestrate workflows across platforms. I11: Once an MCP server connection is created in ODC Portal and its tools imported as server actions, agents can call them, with OAuth, API key or no authentication. I12: Workflows chain several agents, each with its own lifecycle, passing one agent's output to the next. I13: Agentic apps can delegate tasks to external agents, outside ODC, over the A2A protocol. I14: The A2A connector implements version 0.3.0 of the published Agent2Agent protocol, reading the remote agent card. I17: In the documented human-in-the-loop pattern the agent works on its own and stops for a person at a low-confidence or high-stakes trigger. I18: In a workflow, agents run as automatic activities completed without human intervention, and a Human activity assigned to a user or role pauses the workflow until that person approves or rejects the agent's output. I20: The product page states what Agent Workbench is for: designing, building, governing and scaling agentic AI systems. I21: The builder grants each agent a defined set of server actions and can set a call condition that stops it on token, loop or call counts. I22: The guardrails page documents where guardrails do not apply: files, some languages in basic-coverage regions, and two unsupported regions. I25: The builder grants each agent a set of server actions it may call; with none granted, the agent relies only on the AI model's knowledge. I38: The human-in-the-loop pattern stops at a high-stakes trigger until a person verifies or decides. I39: A human activity pauses the agent workflow until an assigned person acts; a call condition also stops an agent's action loop. I40: The human activity is assigned to a named user or role who reviews the agent's output. I47: Each agent's system prompt sets its role, behaviour and constraints in natural language. I48: Guardrail policies (filters, denied topics, word lists, regex PII patterns) are checked on every agent call and can block it. I58: The docs describe agent grounding data: internal aggregates, search services and external tools. I61: The docs list the supported model providers (OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Gemini and others) and the trial models. S1: TeamWork, a named customer, says Agent Workbench helps it equip its consultants with AI tools and that some of its apps are built with it; the page ties no usage figure or named agent to Agent Workbench, dates its count of 4 agents in production from early 2024, and gives its support results as expectations. S3: An llms.txt resolves at the www.outsystems.com site root (fetched 2026-11-10). OutSystems Woodson Martin Paulo Rosado Luis Blando Fay Sien Goon Kim Seabrook Kris Lande TeamWork The Arch Company Axos Bank Thermo Fisher Scientific Grihum Housing Finance OutSystems Agent Workbench OutSystems Agent Workbench A4 · R3 · C2 · O2 Mentor Mentor OutSystems Agent Experience (OutSystems MCP) OutSystems Agent Experience OutSystems Developer Cloud (ODC) and OutSystems 11 OutSystems Developer Cloud outsystems.com/platform/agentic-a… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… extranetprdintegrations.outsystem… outsystems.com/case-studies/teamw… outsystems.com/llms.txt It is configured on a low-code or no-code builder and acts on real organisational data I03 It executes actions itself I08 It works across several domains or systems I10 It connects to external tools or services across a trust boundary I11 Several agents coordinate inside the organisation I12 Agents operate across organisational boundaries or disparate stacks I13 There is a published protocol or communication layer between agents I14 The agent handles routine tasks; the person is consulted on exceptions I17 The agent works independently; the person approves critical decisions only I18 Its purpose and permitted tasks are stated in writing I20 Its autonomy limits and the tools it may use are defined I21 Its limits and known failure cases are documented for those who use it I22 It asks for narrower access than the whole account I25 High-impact actions need a person's approval I38 There is a way to pause or stop it I39 There is a defined escalation path I40 A limit on it is a rule in prose I47 Policy is enforced as machine-readable rules I48 The data it uses is described I58 The models and third-party components it uses are listed I61 It is in production: a public source names a customer or gives usage figures for what it does on its own S1 It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card S3 Salesforce 17 EAAMM 4 OWASP 11 MCP authorization 4 AAGMM 4 Microsoft 7 NIST AI RMF 12 EU AI Act 2 OWASP, AT3 Citizen Developer Agent Salesforce, Level 2: Simple Orchestration, Single Domain Salesforce, Level 1, how to advance from Level 1 to Level 2 Microsoft, 200: Repeatable, Business strategy Salesforce, Level 3: Complex Orchestration, Multiple Domain Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 Microsoft, 400: Capable, Business strategy Microsoft, 200: Repeatable, Technology and data OWASP, AT6 Externally Extended Agent NIST AI RMF, GOVERN 6.1 NIST AI RMF, MAP 4.1 OWASP, AT7 Multi-Agent Orchestration Salesforce, Level 2, how to advance from Level 2 to Level 3 Microsoft, 500: Efficient, Technology and data AAGMM, GD-09 OWASP, AT8 Federated / Cross Boundary Salesforce, Level 4: Multi-Agent Orchestration Salesforce, Level 3, how to advance from Level 3 to Level 4 Salesforce, Level 4, how to maximize value Salesforce, Level 3, how to advance from Level 3 to Level 4 Salesforce, Level 2, how to advance from Level 2 to Level 3 EAAMM, L3 Consultative (survey item Q9) EAAMM, L4 Supervisory (survey item Q9) NIST AI RMF, MAP 1.1 NIST AI RMF, MAP 2.1 NIST AI RMF, MAP 3.3 NIST AI RMF, MAP 1.3 EU AI Act, Article 13 OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action NIST AI RMF, MAP 2.2 Microsoft, 300: Defined, Business strategy NIST AI RMF, MEASURE 2.5 MCP authorization, Authorization (draft) Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 AAGMM, GD-02 MCP authorization, Authorization (draft) OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action EU AI Act, Article 14 AAGMM, GD-06 NIST AI RMF, MAP 3.5 Salesforce, Level 3, how to advance from Level 3 to Level 4 OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action NIST AI RMF, MANAGE 2.4 EAAMM, Prerequisite, L2 to L3 NIST AI RMF, GOVERN 3.2 OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action Microsoft, 500: Efficient, AI governance and security AAGMM, GD-05 EAAMM, Readiness dimension 2 Salesforce, Level 0, how companies can advance from Level 0 to Level 1 Salesforce, Level 1, how to advance from Level 1 to Level 2 OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action NIST AI RMF, MAP 1.4 Microsoft, 400: Capable, Business strategy Salesforce, Level 0, how companies can advance from Level 0 to Level 1 MCP authorization, Authorization (draft) MCP authorization, Authorization (draft) ## The evidence | Source | Read | SHA-256 (first 16) | |---|---|---| | [en.wikipedia.org/wiki/OutSystems](https://en.wikipedia.org/wiki/OutSystems) | 2026-11-10T10:39Z | `15331d8c27ad1417` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) | 2026-11-10T15:46Z | `4bebd8d78dce8555` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) | 2026-11-10T15:46Z | `409bddbad33512f9` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) | 2026-11-10T15:46Z | `ad4921b706fb6cc0` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) | 2026-11-10T15:46Z | `adaf537c0b182a67` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) | 2026-11-10T15:46Z | `7bc6c8084a21d0cf` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=7a08a9ca-8a6e-4f48-9079-8f840ce01a7b) | 2026-11-10T15:46Z | `097ef20137456425` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=8764e4f7-25f3-4a21-b6a9-000c59f4a93a) | 2026-11-10T15:46Z | `305b5bf8b523b55b` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) | 2026-11-10T15:46Z | `b9307656fbaee2ea` | | [extranetprdintegrations.outsystems.net/Documentation_API/rest/getConte](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=af45db6e-ac0f-4ab9-8e4a-4ba8fd559812) | 2026-11-10T15:46Z | `0727bf95007ca798` | | [thenewstack.io/outsystems-launches-a-low-code-workbench-for-building-e](https://thenewstack.io/outsystems-launches-a-low-code-workbench-for-building-enterprise-ai-agents/) | 2026-11-10T10:39Z | `fb1a8c1da5e2fea5` | | [www.outsystems.com/case-studies/teamwork-ai-agents/](https://www.outsystems.com/case-studies/teamwork-ai-agents/) | 2026-11-10T15:46Z | `632f93d6aa40cf3e` | | [www.outsystems.com/company/](https://www.outsystems.com/company/) | 2026-11-10T10:39Z | `cf2b6903bd19c943` | | [www.outsystems.com/company/offices/](https://www.outsystems.com/company/offices/) | 2026-11-10T10:39Z | `0b6f5ebcac6fae95` | | [www.outsystems.com/llms.txt](https://www.outsystems.com/llms.txt) | 2026-11-10T15:46Z | `570b2029b8c6dd4d` | | [www.outsystems.com/news/agent-workbench-general-availability/](https://www.outsystems.com/news/agent-workbench-general-availability/) | 2026-11-10T10:39Z | `18225ae04f19a238` | | [www.outsystems.com/platform/agentic-ai-workbench](https://www.outsystems.com/platform/agentic-ai-workbench) | 2026-11-10T15:46Z | `b8d83b34ccd1be37` | | [www.outsystems.com/trust/](https://www.outsystems.com/trust/) | 2026-11-10T10:39Z | `6a431ccaa0870c84` | ## How this report was made A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The [deterministic scorer](../../spectrum/pipeline/index.md) computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); OutSystems Agent Workbench: reviewed in 3 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come. | Role | Who | |---|---| | researcher-assessor | a sub-agent of gamma.studio@web-summit.dinis | | challenger | a sub-agent | | scorer | build/spectrum.mjs | | analyst, designer, writer | gamma.studio@web-summit.dinis | | review | gamma.review@web-summit.dinis, 3 rounds | | sign-off | gamma.approve@web-summit.dinis, 2026-11-10 | ## The vault Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (`ivinvfhj`). Read key: sgit_public_read_a787d5ebd3b7fca03039c35a5d95311a66cc5581cbc41eec0ad3ab0c46272feb:ivinvfhj With [sgit](https://sgit.ai/): `sgit clone` followed by the key. The key reads; it cannot write. ## Corrections None yet. A correction is made in place, dated here, and carried to the card, the vault and the article. ## The article [OutSystems Agent Workbench on the GAMMA-Ray Spectrum: A4 · R3 · C2 · O2](article.md), written from this report for PrompTugal.news.