# Scan: RiskMandate Publisher > GAMMA-Ray v0.0.3 (beta, for review; every rating is experimental). A GAMMA-Ray beta rating of RiskMandate Publisher: reaches freedom 5, governance 1, held at 2. > Page: https://gamma-ray.sgit.ai/scans/riskmandate-publisher/ · Source: data/scans/riskmandate-publisher.json Beta rating · Public tier · read 2026-11-10 · one of our own agents The agent that reads RiskMandate's private stories vault and writes the public site riskmandate.ai. Scanned from its own published Agent Behaviour Policy. The publisher of this site is behind RiskMandate: a scan of ourselves. *Figure. The label for this rating; its contents are in the text.* 5 Freedom reached Coordinates 1 Governance evidenced Stated (claims 2) 2 Level held 3 below what it reaches *Figure. The quadrant of freedom against governance; the levels are in the text.* ## How to read it The agent reaches freedom level 5 (Coordinates: agents working with agents; the person approves critical decisions or observes). Its evidenced governance is level 1 (Stated: what it is for and the rules for it are written down), which clears freedom up to level 2. So it is **held at 2**. By its own statements it would be at governance 2 and held at 3. The difference is 3 answers about how it operates that are stated but not observed. 18 of 69 indicators count as evidenced. An indicator with no evidence is reported as not evidenced; it is never read as a no. ## The profile *Figure. One square per indicator, by question; every answer is listed below.* ## The grant: what it can actually do The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given. *Figure. The grant as a grid of capabilities; the table below has every row.* | | | |---|---| | The grant | 17 of the 23 capabilities | | Behind a boundary (the only barrier that is a control) | 3 | | With nothing, a rule in prose or a setting in the way | 14 | | Capabilities whose effect cannot be undone | 8, of which 6 are not behind a boundary | | Rows observed or measured on the thing itself | 15 of 17 | | The mandate | 13 capabilities wanted, 2 refused | | Aligned (granted and wanted) | 13 | | **Excess** (granted, not wanted) | **4**, of which 3 with no boundary | | **Refused by the mandate, and in the grant** | **2**: `grant.credential.self`, `read.credential.host` | | Shortfall (wanted, not granted) | 0 | Source: [riskmandate/team/publisher](https://riskmandate.ai/team/publisher.json), profile version 2026-09-26. | Capability | Barrier | How it is known | |---|---|---| | `read.file.project` | none | observed | | `write.file.project` | none | observed | | `write.repository.project` | none | observed | | `write.repository.tenant` | setting | observed | | `create.record.world` | setting | observed | | `send.endpoint.allowed` | boundary | observed | | `authenticate-as.credential.tenant` | boundary | observed | | `authenticate-as.credential.signing` | none | observed | | `read.credential.host` | none | observed | | `grant.credential.self` | none | documented | | `execute.process.host` | none | observed | | `write.file.host` | none | observed | | `read.file.host` | none | observed | | `delete.file.host` | none | observed | | `read.record.history` | none | observed | | `create.schedule.tenant` | setting | self-reported | | `create.schedule.host` | boundary | measured | ## The work order What stands between this agent and governance level 2, most consequential first: 1. **Refused, and granted.** `read.credential.host` is refused by the mandate and is in the grant with nothing in the way. 2. **Refused, and granted.** `grant.credential.self` is refused by the mandate and is in the grant with nothing in the way. 3. **Cannot be undone, and not bounded.** 6 of the 8 capabilities in the grant whose effect cannot be undone are not behind a boundary: `create.record.world`, `authenticate-as.credential.signing`, `read.credential.host`, `read.file.host`, `delete.file.host`, `read.record.history`. 4. **Claimed, not shown.** Its actions are logged: stated, but known only as self-reported; it has to be observed or measured to count. ## What its evidence reaches *Figure. The mashup graph with this agent's evidenced indicators lit.* ## Every answer, with its source ### What is the agent built on? - *Not evidenced.* It is a vendor's assistant, used as supplied. - *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code. - *Not evidenced.* It is configured on a low-code or no-code builder and acts on real organisational data. - **In this deployment.** It generates and executes code with local or cloud privileges. Runs as Claude Code on the web, in a managed container. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries. ### Does it act, or only answer and recommend? - *Not evidenced.* It follows fixed rules, with no reasoning. - *Not evidenced.* It retrieves information and recommends actions; a person acts. - **In this deployment.** It executes actions itself. It publishes releases to the branch the site deploys from. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) ### How far does it reach? - *Not evidenced.* It works in one domain's data. - **In this deployment.** It works across several domains or systems. The repository, the stories vault and the live site. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - **In this deployment.** It connects to external tools or services across a trust boundary. The code host and the vault host. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) ### Does it work with other agents? - **In this deployment.** Several agents coordinate inside the organisation. One person and two agents; the publisher checks what the design studio agent delivers. [Source](https://riskmandate.ai/team/) (self-reported) - *Not evidenced.* Agents operate across organisational boundaries or disparate stacks. - *Not evidenced.* There is a published protocol or communication layer between agents. ### What is the person's role? - *Not evidenced.* The person operates: every action is prompted and controlled by them. - *Not evidenced.* The agent suggests; the person reviews and approves each action. - *Not evidenced.* The agent handles routine tasks; the person is consulted on exceptions. - **In this deployment.** The agent works independently; the person approves critical decisions only. It publishes what the lead has accepted; it does not decide. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* The agent has full autonomy within boundaries; the person monitors. ### Is what it is for written down? - **In this deployment.** Its purpose and permitted tasks are stated in writing. The mandate is written: wanted, refused and unstated. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - **In this deployment.** Its autonomy limits and the tools it may use are defined. Its tools and skills are listed. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* Its limits and known failure cases are documented for those who use it. ### Does it have its own identity and only the access it needs? - **Claimed, not counted.** What it can reach is enumerated: scopes, permissions, tools. The grant: 17 of the 23 primitives, each with how it is known. [Source](https://riskmandate.ai/team/publisher.html) (self-reported; this fact has to be observed or measured to count) - *Not evidenced.* Its authorisation is published as metadata that anyone can read. - *Not evidenced.* It asks for narrower access than the whole account. - *Not evidenced.* It has its own identity, separate from any person's. - **In this deployment.** Its identity is cryptographic and can be checked by others. A lane identity with a public key. [Source](https://riskmandate.ai/agents/) (self-reported) - *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on. ### Is it in a registry, with an owner? - **In this deployment.** The organisation keeps a registry of its agents. The team page lists the agents. [Source](https://riskmandate.ai/team/) (self-reported) - **In this deployment.** Each agent has a named owner. Owner: the lead. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* Agents are retired by a defined process. ### Who is accountable for it? - **In this deployment.** A named executive or body is accountable for the organisation's agents. The lead is the accountable person. [Source](https://riskmandate.ai/team/) (self-reported) - *Not evidenced.* Roles and responsibilities for AI risk are documented. ### Is there a policy that governs it? - **In this deployment.** A governance policy for agents is published. Its Agent Behaviour Policy is the published policy. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* Agents and use cases are classed by risk. - *Not evidenced.* The laws that apply to it are identified. - *Not evidenced.* New agents pass an approval or review before they run. ### Can a person step in or stop it? - **In this deployment.** High-impact actions need a person's approval. Only what the lead has accepted by message goes into a story. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* There is a way to pause or stop it. - *Not evidenced.* There is a defined escalation path. ### Is what it does logged? - **Claimed, not counted.** Its actions are logged. Every release is a written note in the version record. That records releases, not what the agent did between them. [Source](https://riskmandate.ai/versions.html) (self-reported; this fact has to be observed or measured to count) - *Not evidenced.* The log is tamper-evident and kept for a stated time. ### Is it watched while it runs? - *Not evidenced.* It is monitored in operation. - *Not evidenced.* Anomalies are detected in real time and raise alerts. ### What stands between it and what it should not do? - **Claimed, not counted.** A limit on it is enforced by something outside its own reach. Every outside request goes through an egress proxy above the container. [Source](https://riskmandate.ai/team/publisher.html) (self-reported; this fact has to be observed or measured to count) - *Not evidenced.* A limit on it is a setting that its own account could change. - **In this deployment.** A limit on it is a rule in prose. Several limits are prose: the page says the grant does not know them. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* Policy is enforced as machine-readable rules. - **In this deployment.** The difference between what it can reach and what it is for is stated. The delta is stated: 4 in excess, 3 unbounded. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) ### Is it tested, and are the results shown? - *Not evidenced.* Test or evaluation results are published. - *Not evidenced.* It is tested for safety and security, including by attack. - *Not evidenced.* People who did not build it take part in assessing it. ### What happens when it goes wrong? - *Not evidenced.* There is an incident process for agents. - *Not evidenced.* Incidents and errors are communicated to those affected. - *Not evidenced.* There is a plan for a failure of a third party it depends on. ### Do people know it is an AI, and can they answer back? - **In this deployment.** It tells the people it talks to that it is an AI. The site says which agents make it. [Source](https://riskmandate.ai/team/) (self-reported) - *Not evidenced.* There is a channel to report problems with it or contest its output. ### What data does it use, and under what rules? - *Not evidenced.* The data it uses is described. - *Not evidenced.* There are data quality rules for what it reads. - *Not evidenced.* Its privacy risk has been examined. ### What does it depend on from others? - **In this deployment.** The models and third-party components it uses are listed. The runtime is named. [Source](https://riskmandate.ai/team/publisher.html) (self-reported) - *Not evidenced.* Third-party components are monitored and have risk controls. ### Has anyone independent checked? - *Not evidenced.* A public certificate or audit report covers it. - *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator. ### Is the organisation behind it ready? - *Not evidenced.* There is a stated strategy for agents. - *Not evidenced.* The people who work with it are trained. - *Not evidenced.* Its value is measured. - *Not evidenced.* It is improved on a regular cycle. - *Not evidenced.* The organisation's risk management covers agents. ## The vault This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`wkm0whjx`, published 2026-11-10). Anyone can read it with this key: `sgit_public_read_08c5b57dfb7a1529422797cc981591e00aa9aea87b04a54486d266e859241bdd:wkm0whjx` With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_08c5b57dfb7a1529422797cc981591e00aa9aea87b04a54486d266e859241bdd:wkm0whjx`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.