# Scan: Manus > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of Manus: freedom 1, 1, 4, 4, 1, 1 across its configurations; deployment governance not assessed. > Page: https://gamma-ray.sgit.ai/scans/manus-agent/ · Source: data/scans/manus-agent.json Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor Manus AI's general agent that plans and carries out tasks for a user in a cloud sandbox, and also through a desktop app, a browser extension and an API. A scan of a product as its vendor documents it, not of any one deployment. Made by the report studio: a researcher-assessor, a challenger, then the scorer. Built only from Manus AI's own public documentation, API documentation, security page, blog and customer stories, and its published llms.txt and OpenAPI file. Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated. *Figure. The label for this rating; its contents are in the text.* 1 Freedom as shipped Answers 4 Freedom at most Acts widely 6 Controls it brings as shipped n/a Deployment governance not assessed ## How to read it This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings. *Figure. The freedom level of each configuration; the table has the same.* | Configuration | What changes | Freedom | Controls | Turned on by the operator | |---|---|---|---|---| | **As shipped** | The agent in Manus's cloud sandbox with its defaults, no apps connected. | 1 Answers | 6 | nothing | | **With connectors** | The user connects apps (for example Gmail or Notion) or MCP servers. | 1 Answers | 6 | it works across several domains or systems | | **Manus Studio, working locally** | The desktop app with Work locally on, in its default permission mode. | 4 Acts widely | 8 | the agent handles routine tasks; the person is consulted on exceptions; its autonomy limits and the tools it may use are defined; a limit on it is a setting that its own account could change | | **Manus Studio, ask for approval** | The desktop app in the permission mode Ask for approval. | 4 Acts widely | 8 | the agent suggests; the person reviews and approves each action; the agent handles routine tasks; the person is consulted on exceptions; its autonomy limits and the tools it may use are defined; a limit on it is a setting that its own account could change | | **Browser Operator** | The extension lets the agent work in the user's own browser. | 1 Answers | 8 | its limits and known failure cases are documented for those who use it; its actions are logged | | **Through the API** | An integrator runs Manus through its API and answers its confirmation events in its own interface. | 1 Answers | 7 | high-impact actions need a person's approval | The same product is a different agent in each row. A rating of a deployment starts by saying which row it is. An indicator with no evidence is reported as not evidenced; it is never read as a no. ## The profile *Figure. One square per indicator, by question; every answer is listed below.* ## The grant: what it can actually do The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given. **Not measured.** Not measured. No deployment shape for this product is published in the capability grammar. ## Seen, and not credited - The API's task lifecycle says the agent runs asynchronously after a task is created, and a list of action types can wait for confirmation. The list includes ordinary actions such as running a command, so it does not show an agent that works independently with a person approving only critical decisions. [Source](https://open.manus.ai/docs/v2/task-lifecycle.md) ## What its evidence reaches *Figure. The mashup graph with this agent's evidenced indicators lit.* ## Every answer, with its source ### What is the agent built on? - *Not evidenced.* It is a vendor's assistant, used as supplied. - *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code. - *Not evidenced.* It is configured on a low-code or no-code builder and acts on real organisational data. - **As shipped.** It generates and executes code with local or cloud privileges. The sandbox post says the agent works in its own cloud virtual machine and solves problems by writing code. [Source](https://manus.im/blog/manus-sandbox) (documented) - *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries. ### Does it act, or only answer and recommend? - *Not evidenced.* It follows fixed rules, with no reasoning. - *Not evidenced.* It retrieves information and recommends actions; a person acts. - **As shipped.** It executes actions itself. The API docs list actions the agent carries out in its task loop, such as sending email, changing calendar events, running terminal commands and deploying a service. This is the API's documentation of the task loop. [Source](https://open.manus.ai/docs/v2/task-lifecycle/confirmation-events.md) (documented) - **As shipped.** It is in production: a public source names a customer or gives usage figures for what it does on its own. A vendor-published customer story names k-ID and states its count of Manus sessions. [Source](https://manus.im/blog/k-id-customer-story) (documented) ### How far does it reach? - *Not evidenced.* It works in one domain's data. - **Available, if the operator turns it on.** It works across several domains or systems. Connectors let the agent read data from and act in apps such as Gmail and Notion once the user connects them. [Source](https://manus.im/docs/introduction/quickstart.md) (documented) - **As shipped.** It connects to external tools or services across a trust boundary. The Similarweb data integration is used without setup, the agent fetching metrics from the external service. [Source](https://manus.im/blog/similarweb-manus) (documented) ### Does it work with other agents? - *Not evidenced.* Several agents coordinate inside the organisation. - *Not evidenced.* Agents operate across organisational boundaries or disparate stacks. - *Not evidenced.* There is a published protocol or communication layer between agents. - *Not evidenced.* Others build on it: third parties publish integrations, skills or agents for it. - *Not evidenced.* It exposes an agent interface: a published MCP server, an agent card, or an API documented for agents to call. ### What is the person's role? - *Not evidenced.* The person operates: every action is prompted and controlled by them. - **Available, if the operator turns it on.** The agent suggests; the person reviews and approves each action. In Manus Studio the Ask for approval mode asks before every local action. [Source](https://manus.im/docs/features/desktop.md) (documented) - **Available, if the operator turns it on.** The agent handles routine tasks; the person is consulted on exceptions. In Manus Studio the default Approve for me mode auto-approves safe local actions and asks the person when a decision is needed. [Source](https://manus.im/docs/features/desktop.md) (documented) - *Not evidenced.* The agent works independently; the person approves critical decisions only. - *Not evidenced.* The agent has full autonomy within boundaries; the person monitors. ### Is what it is for written down? - **As shipped.** Its purpose and permitted tasks are stated in writing. The documentation states what the agent is for and describes the kinds of tasks it completes. [Source](https://manus.im/docs/introduction/welcome.md) (documented) - **Available, if the operator turns it on.** Its autonomy limits and the tools it may use are defined. Manus Studio's permission modes define which local actions run without approval and which need it, with the list of actions that need approval. [Source](https://manus.im/docs/features/desktop.md) (documented) - **Available, if the operator turns it on.** Its limits and known failure cases are documented for those who use it. The Browser Operator page lists limitations, including complex interactions and sites with anti-bot measures. [Source](https://manus.im/docs/features/browser-operator.md) (documented) ### Does it have its own identity and only the access it needs? - *Not evidenced.* What it can reach is enumerated: scopes, permissions, tools. - *Not evidenced.* Its authorisation is published as metadata that anyone can read. - *Not evidenced.* It asks for narrower access than the whole account. - *Not evidenced.* It has its own identity, separate from any person's. - *Not evidenced.* Its identity is cryptographic and can be checked by others. - *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on. ### Is it in a registry, with an owner? - *Not evidenced.* The organisation keeps a registry of its agents. - *Not evidenced.* Each agent has a named owner. - *Not evidenced.* Agents are retired by a defined process. ### Who is accountable for it? - *Not evidenced.* A named executive or body is accountable for the organisation's agents. - *Not evidenced.* Roles and responsibilities for AI risk are documented. ### Is there a policy that governs it? - *Not evidenced.* A governance policy for agents is published. - *Not evidenced.* Agents and use cases are classed by risk. - *Not evidenced.* The laws that apply to it are identified. - *Not evidenced.* New agents pass an approval or review before they run. ### Can a person step in or stop it? - **Available, if the operator turns it on.** High-impact actions need a person's approval. The API's confirmation events list action types that wait for the user before they run, among them sending email, deleting calendar events, deploying a service and running a command; the page is for integrators who build their own confirmation interface, does not say when the waits occur in the app, and some types accept global_allow, which skips later ones. [Source](https://open.manus.ai/docs/v2/task-lifecycle/confirmation-events.md) (documented) - **As shipped.** There is a way to pause or stop it. The API has an endpoint that stops a running task; the Studio page also says the person can stop a task at any time. [Source](https://open.manus.ai/docs/v2/task.stop.md) (documented) - *Not evidenced.* There is a defined escalation path. ### Is what it does logged? - **Available, if the operator turns it on.** Its actions are logged. With the Browser Operator extension, the page states all of the agent's actions in the browser are logged; through the API, the tools the agent used come back only with verbose=true. [Source](https://manus.im/docs/features/browser-operator.md) (documented) - *Not evidenced.* The log is tamper-evident and kept for a stated time. ### Is it watched while it runs? - *Not evidenced.* It is monitored in operation. - *Not evidenced.* Anomalies are detected in real time and raise alerts. ### What stands between it and what it should not do? - *Not evidenced.* A limit on it is enforced by something outside its own reach. - **Available, if the operator turns it on.** A limit on it is a setting that its own account could change. Studio's permission mode is a setting the task owner changes, including to Full access. [Source](https://manus.im/docs/features/desktop.md) (documented) - *Not evidenced.* A limit on it is a rule in prose. - *Not evidenced.* Policy is enforced as machine-readable rules. - *Not evidenced.* The difference between what it can reach and what it is for is stated. ### Is it tested, and are the results shown? - *Not evidenced.* Test or evaluation results are published. - *Not evidenced.* It is tested for safety and security, including by attack. - *Not evidenced.* People who did not build it take part in assessing it. ### What happens when it goes wrong? - *Not evidenced.* There is an incident process for agents. - **As shipped.** Incidents and errors are communicated to those affected. A public status page for manus.im, api.manus.im and the Manus computer offers email, Slack and Teams notices when an incident is created, updated or resolved. [Source](https://status.manus.im/) (documented) - *Not evidenced.* There is a plan for a failure of a third party it depends on. ### Do people know it is an AI, and can they answer back? - *Not evidenced.* It tells the people it talks to that it is an AI. - **As shipped.** There is a channel to report problems with it or contest its output. The help centre offers a support chat and articles on feature issues and task errors. [Source](https://help.manus.im/) (documented) - **As shipped.** It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card. An llms.txt resolves for the product docs, and a second llms.txt and an OpenAPI 3.1 description resolve for the API. [Source](https://manus.im/docs/llms.txt) (observed) ### What data does it use, and under what rules? - **As shipped.** The data it uses is described. The sandbox post lists what the task sandbox stores, and the Studio page says what is sent to the cloud. [Source](https://manus.im/blog/manus-sandbox) (documented) - *Not evidenced.* There are data quality rules for what it reads. - *Not evidenced.* Its privacy risk has been examined. ### What does it depend on from others? - *Not evidenced.* The models and third-party components it uses are listed. - *Not evidenced.* Third-party components are monitored and have risk controls. ### Has anyone independent checked? - *Not evidenced.* A public certificate or audit report covers it. - *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator. ### Is the organisation behind it ready? - *Not evidenced.* There is a stated strategy for agents. - *Not evidenced.* The people who work with it are trained. - *Not evidenced.* Its value is measured. - *Not evidenced.* It is improved on a regular cycle. - *Not evidenced.* The organisation's risk management covers agents. ## The vault This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`wcvaw1bi`, published 2026-11-10). Anyone can read it with this key: `sgit_public_read_5ab82ed8d04719fb9fa7ffa28ef3cbd9eec71b4b03b2958ee62f470c3c1e6ba9:wcvaw1bi` With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_5ab82ed8d04719fb9fa7ffa28ef3cbd9eec71b4b03b2958ee62f470c3c1e6ba9:wcvaw1bi`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.