# Scan: OutSystems Agent Workbench > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of OutSystems Agent Workbench: freedom 1, 4, 1, 1, 1, 1 across its configurations; deployment governance not assessed. > Page: https://gamma-ray.sgit.ai/scans/outsystems-agent-workbench/ · Source: data/scans/outsystems-agent-workbench.json Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor Builds, runs and governs AI agents (agentic apps) on OutSystems Developer Cloud (ODC): agents call server actions, MCP tools and external A2A agents, with guardrails, evaluations, traces and workflow human-in-the-loop steps. A scan of a product as its vendor documents it, not of any one deployment. Made by the report studio: a researcher-assessor, a challenger, then the scorer. Part of the first Portuguese cohort. Built only from OutSystems's own public pages (product, documentation, blog, customer stories, legal and security pages). Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated. *Figure. The label for this rating; its contents are in the text.* 1 Freedom as shipped Answers 4 Freedom at most Acts widely 8 Controls it brings as shipped n/a Deployment governance not assessed ## How to read it This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings. *Figure. The freedom level of each configuration; the table has the same.* | Configuration | What changes | Freedom | Controls | Turned on by the operator | |---|---|---|---|---| | **As shipped** | OutSystems Agent Workbench with its documented defaults. | 1 Answers | 8 | nothing | | **Hitl workflow** | The builder places the agent in an ODC workflow with a Human activity assigned to a user or role; not part of an agent by default. | 4 Acts widely | 11 | the agent handles routine tasks; the person is consulted on exceptions; the agent works independently; the person approves critical decisions only; high-impact actions need a person's approval; there is a way to pause or stop it; there is a defined escalation path | | **Guardrails** | Agent guardrails enabled by an administrator (stage baseline) or a developer (per agent) in the ODC Portal; usage is charged through Agent Workbench add-on packs; not enforced in two regions. | 1 Answers | 9 | policy is enforced as machine-readable rules | | **Agent workflow** | The builder chains several agents as automatic activities in an ODC workflow (sequential, parallel or loop); not part of a single agent by default. | 1 Answers | 8 | several agents coordinate inside the organisation | | **A2a connection** | An administrator creates an A2A connection to an external agent in the ODC Portal and the builder adds its SendMessage action to the agent; ODC acts as A2A 0.3.0 client only. | 1 Answers | 8 | agents operate across organisational boundaries or disparate stacks; there is a published protocol or communication layer between agents | | **MCP connection** | An administrator creates a connection to an MCP server in the ODC Portal and imports selected tools as server actions, which the builder adds to the agent; not part of an agent by default. | 1 Answers | 8 | it connects to external tools or services across a trust boundary | The same product is a different agent in each row. A rating of a deployment starts by saying which row it is. An indicator with no evidence is reported as not evidenced; it is never read as a no. ## The profile *Figure. One square per indicator, by question; every answer is listed below.* ## The grant: what it can actually do The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given. **Not measured.** Not measured. No deployment shape for this product is published in the capability grammar. ## Seen, and not credited - I41 Its actions are logged Unchanged from round one: the monitoring page lets logs and traces be filtered by agent and kept four weeks but does not say the agent's action calls are recorded, and an operation fact needs an observed or measured grade. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=ca7cae65-c466-4d93-bab6-85ac740519c0) - S1 usage figures for Agent Workbench The TeamWork case study gives '4 AI agents in production since early 2024' and expected support results, but ties neither the count nor any named agent to Agent Workbench; only the customer and its quote are credited. [Source](https://www.outsystems.com/case-studies/teamwork-ai-agents/) ## What its evidence reaches *Figure. The mashup graph with this agent's evidenced indicators lit.* ## Every answer, with its source ### What is the agent built on? - *Not evidenced.* It is a vendor's assistant, used as supplied. - *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code. - **As shipped.** It is configured on a low-code or no-code builder and acts on real organisational data. Agents are built in a visual drag-and-drop builder on the OutSystems platform and connect to enterprise data such as ERP and CRM systems. [Source](https://www.outsystems.com/platform/agentic-ai-workbench) (documented) - *Not evidenced.* It generates and executes code with local or cloud privileges. - *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries. ### Does it act, or only answer and recommend? - *Not evidenced.* It follows fixed rules, with no reasoning. - *Not evidenced.* It retrieves information and recommends actions; a person acts. - **As shipped.** It executes actions itself. Agents call the server actions granted to them, the AI model deciding which action or sequence of actions to run. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (documented) - **As shipped.** It is in production: a public source names a customer or gives usage figures for what it does on its own. TeamWork, a named customer, says Agent Workbench helps it equip its consultants with AI tools and that some of its apps are built with it; the page ties no usage figure or named agent to Agent Workbench, dates its count of 4 agents in production from early 2024, and gives its support results as expectations. [Source](https://www.outsystems.com/case-studies/teamwork-ai-agents/) (documented) ### How far does it reach? - *Not evidenced.* It works in one domain's data. - **As shipped.** It works across several domains or systems. The product FAQ says agents connect to APIs, databases, ERP, CRM and legacy systems and orchestrate workflows across platforms. [Source](https://www.outsystems.com/platform/agentic-ai-workbench) (documented) - **Available, if the operator turns it on.** It connects to external tools or services across a trust boundary. Once an MCP server connection is created in ODC Portal and its tools imported as server actions, agents can call them, with OAuth, API key or no authentication. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=7a08a9ca-8a6e-4f48-9079-8f840ce01a7b) (documented) ### Does it work with other agents? - **Available, if the operator turns it on.** Several agents coordinate inside the organisation. Workflows chain several agents, each with its own lifecycle, passing one agent's output to the next. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (documented) - **Available, if the operator turns it on.** Agents operate across organisational boundaries or disparate stacks. Agentic apps can delegate tasks to external agents, outside ODC, over the A2A protocol. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) (documented) - **Available, if the operator turns it on.** There is a published protocol or communication layer between agents. The A2A connector implements version 0.3.0 of the published Agent2Agent protocol, reading the remote agent card. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=8764e4f7-25f3-4a21-b6a9-000c59f4a93a) (documented) - *Not evidenced.* Others build on it: third parties publish integrations, skills or agents for it. - *Not evidenced.* It exposes an agent interface: a published MCP server, an agent card, or an API documented for agents to call. ### What is the person's role? - *Not evidenced.* The person operates: every action is prompted and controlled by them. - *Not evidenced.* The agent suggests; the person reviews and approves each action. - **Available, if the operator turns it on.** The agent handles routine tasks; the person is consulted on exceptions. In the documented human-in-the-loop pattern the agent works on its own and stops for a person at a low-confidence or high-stakes trigger. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (documented) - **Available, if the operator turns it on.** The agent works independently; the person approves critical decisions only. In a workflow, agents run as automatic activities completed without human intervention, and a Human activity assigned to a user or role pauses the workflow until that person approves or rejects the agent's output. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (documented) - *Not evidenced.* The agent has full autonomy within boundaries; the person monitors. ### Is what it is for written down? - **As shipped.** Its purpose and permitted tasks are stated in writing. The product page states what Agent Workbench is for: designing, building, governing and scaling agentic AI systems. [Source](https://www.outsystems.com/platform/agentic-ai-workbench) (documented) - **As shipped.** Its autonomy limits and the tools it may use are defined. The builder grants each agent a defined set of server actions and can set a call condition that stops it on token, loop or call counts. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (documented) - **As shipped.** Its limits and known failure cases are documented for those who use it. The guardrails page documents where guardrails do not apply: files, some languages in basic-coverage regions, and two unsupported regions. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (documented) ### Does it have its own identity and only the access it needs? - *Not evidenced.* What it can reach is enumerated: scopes, permissions, tools. - *Not evidenced.* Its authorisation is published as metadata that anyone can read. - **As shipped.** It asks for narrower access than the whole account. The builder grants each agent a set of server actions it may call; with none granted, the agent relies only on the AI model's knowledge. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (documented) - *Not evidenced.* It has its own identity, separate from any person's. - *Not evidenced.* Its identity is cryptographic and can be checked by others. - *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on. ### Is it in a registry, with an owner? - *Not evidenced.* The organisation keeps a registry of its agents. - *Not evidenced.* Each agent has a named owner. - *Not evidenced.* Agents are retired by a defined process. ### Who is accountable for it? - *Not evidenced.* A named executive or body is accountable for the organisation's agents. - *Not evidenced.* Roles and responsibilities for AI risk are documented. ### Is there a policy that governs it? - *Not evidenced.* A governance policy for agents is published. - *Not evidenced.* Agents and use cases are classed by risk. - *Not evidenced.* The laws that apply to it are identified. - *Not evidenced.* New agents pass an approval or review before they run. ### Can a person step in or stop it? - **Available, if the operator turns it on.** High-impact actions need a person's approval. The human-in-the-loop pattern stops at a high-stakes trigger until a person verifies or decides. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (documented) - **Available, if the operator turns it on.** There is a way to pause or stop it. A human activity pauses the agent workflow until an assigned person acts; a call condition also stops an agent's action loop. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (documented) - **Available, if the operator turns it on.** There is a defined escalation path. The human activity is assigned to a named user or role who reviews the agent's output. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (documented) ### Is what it does logged? - *Not evidenced.* Its actions are logged. - *Not evidenced.* The log is tamper-evident and kept for a stated time. ### Is it watched while it runs? - *Not evidenced.* It is monitored in operation. - *Not evidenced.* Anomalies are detected in real time and raise alerts. ### What stands between it and what it should not do? - *Not evidenced.* A limit on it is enforced by something outside its own reach. - *Not evidenced.* A limit on it is a setting that its own account could change. - **As shipped.** A limit on it is a rule in prose. Each agent's system prompt sets its role, behaviour and constraints in natural language. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (documented) - **Available, if the operator turns it on.** Policy is enforced as machine-readable rules. Guardrail policies (filters, denied topics, word lists, regex PII patterns) are checked on every agent call and can block it. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (documented) - *Not evidenced.* The difference between what it can reach and what it is for is stated. ### Is it tested, and are the results shown? - *Not evidenced.* Test or evaluation results are published. - *Not evidenced.* It is tested for safety and security, including by attack. - *Not evidenced.* People who did not build it take part in assessing it. ### What happens when it goes wrong? - *Not evidenced.* There is an incident process for agents. - *Not evidenced.* Incidents and errors are communicated to those affected. - *Not evidenced.* There is a plan for a failure of a third party it depends on. ### Do people know it is an AI, and can they answer back? - *Not evidenced.* It tells the people it talks to that it is an AI. - *Not evidenced.* There is a channel to report problems with it or contest its output. - **As shipped.** It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card. An llms.txt resolves at the www.outsystems.com site root (fetched 2026-11-10). [Source](https://www.outsystems.com/llms.txt) (observed) ### What data does it use, and under what rules? - **As shipped.** The data it uses is described. The docs describe agent grounding data: internal aggregates, search services and external tools. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (documented) - *Not evidenced.* There are data quality rules for what it reads. - *Not evidenced.* Its privacy risk has been examined. ### What does it depend on from others? - **As shipped.** The models and third-party components it uses are listed. The docs list the supported model providers (OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Gemini and others) and the trial models. [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=af45db6e-ac0f-4ab9-8e4a-4ba8fd559812) (documented) - *Not evidenced.* Third-party components are monitored and have risk controls. ### Has anyone independent checked? - *Not evidenced.* A public certificate or audit report covers it. - *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator. ### Is the organisation behind it ready? - *Not evidenced.* There is a stated strategy for agents. - *Not evidenced.* The people who work with it are trained. - *Not evidenced.* Its value is measured. - *Not evidenced.* It is improved on a regular cycle. - *Not evidenced.* The organisation's risk management covers agents. ## The vault This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`ivinvfhj`, published 2026-11-10). Anyone can read it with this key: `sgit_public_read_a787d5ebd3b7fca03039c35a5d95311a66cc5581cbc41eec0ad3ab0c46272feb:ivinvfhj` With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_a787d5ebd3b7fca03039c35a5d95311a66cc5581cbc41eec0ad3ab0c46272feb:ivinvfhj`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.