# Scans

> GAMMA-Ray v0.0.2 (draft). GAMMA-Ray Public scans: two of our own deployments, and three widely used agent products as examples, each from public evidence and each in a public vault.
> Page: https://gamma-ray.sgit.ai/scans/ · Source: content/scans/index.md


A scan answers the questions for one agent, computes its levels, and shows its grant where one has been measured. These are Public tier scans: from public pages only.

| Agent | Kind | Freedom | Governance | Held at | With its options on | Grant | Behind a boundary |
|---|---|---|---|---|---|---|---|
| [RiskMandate Publisher](riskmandate-publisher/index.md) | our own deployment | 5 Coordinates | 2 Owned | **3** | the same | 17 of 23 | 3 of 17 |
| [The PrompTugal.news agent team](promptugal-newsroom-team/index.md) | our own deployment | 5 Coordinates | 2 Owned | **3** | the same | not measured |  |
| [Claude Code on the web](claude-code-web/index.md) | example: a product as documented | 4 Acts widely as shipped | 0 as shipped: the rest is the operator's | starts at **1** | freedom 5, held at 1 | 15 of 23 | 3 of 15 |
| [Claude Code, on your own machine](claude-code-local/index.md) | example: a product as documented | 2 Suggests as shipped | 0 as shipped: the rest is the operator's | starts at **1** | freedom 5, held at 2 | 16 of 23 | 0 of 16 |
| [GitHub Copilot cloud agent](github-copilot-cloud-agent/index.md) | example: a product as documented | 4 Acts widely as shipped | 0 as shipped: the rest is the operator's | starts at **1** | the same | not measured |  |

*Figure. The quadrant of freedom against governance; the levels are in the text.*

Filled dots are deployments. Hollow dots are products as shipped, and the dashed line runs to where the same product sits with its optional controls and modes turned on.

## Two kinds of scan

**Our own deployments.** We start with our own agents, because a standard should be tried on its authors first. Both reach the top freedom level and are held two levels lower.

**Products, as examples.** A product is not a deployment: it has no owner, no policy and no mandate until somebody runs it. So a product scan is a starting point, not a verdict on its vendor. It says what the product does and controls as shipped, what it can when its options are on, and what its permissions let it do. Each is built only from the vendor's own documentation and published profiles, has not been seen by the vendor, and will be corrected on request.

## What the examples show

- The same product sits at different levels in different shapes. Claude Code on a developer's own machine asks before it acts and has no boundary by default; the same agent in its cloud shape acts on its own inside a container with a proxy above it.
- Freedom is mostly a property of the product. Governance is mostly a property of the deployment: who owns it, what policy it runs under, whether anybody watches.
- A measured grant changes the reading. Where one exists, it shows how many capabilities sit behind a boundary, which no description can.

*Figure. Every scan against every question.*

## Every scan is a vault

Each scan, with its evidence list, its grant and the questions it was made against, is in a public sgit vault. The read key is on the scan's page.