AISLE platform

Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

AISLE's platform of AI agents that finds vulnerabilities in source code, triages them, writes and tests patches, and delivers them as pull requests for people to merge.

What each level rests on

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".

Autonomy: level 4, Orchestrates

What does the agent do on its own? Runs multi-step workflows across systems or coordinates other agents; a person sets goals and reviews outcomes. This level holds with: Fixes as pull requests. As shipped, with nothing turned on, it is not yet evidenced.

• I10 It works across several domains or systems. The platform page states it plugs into the customer's scanners, repositories and CI. "AISLE plugs into the scanners, repos, and CI you already run" Source (read, documented, captured 2026-11-10T15:46Z, sha256 9ede4e7781a0a527) · π Moderate · S1·R5·A1 ×3
• I18 The agent works independently; the person approves critical decisions only. The page states AISLE writes and tests a patch and opens a pull request, that the customer decides per severity and repository how far it goes, and that a person on the customer's team merges; no default is stated. "Nothing reaches your main branch until someone on your team merges it." Source (read, documented, available, captured 2026-11-10T15:46Z, sha256 781c682dd9303d6b) · π Moderate · S1·R5·A1 ×3

This evidence touches 6 provisions: Salesforce, Microsoft, EAAMM.

Reach: level 2, Integrated

How connected is it? Documented connectors to common tools.

• I10 It works across several domains or systems. The platform page states it plugs into the customer's scanners, repositories and CI. "AISLE plugs into the scanners, repos, and CI you already run" Source (read, documented, captured 2026-11-10T15:46Z, sha256 9ede4e7781a0a527) · π Moderate · S1·R5·A1 ×3
• I11 It connects to external tools or services across a trust boundary. AISLE connects from its own service to the customer's hosted version control systems. "AISLE connects to GitHub, GitLab, Bitbucket, and Azure DevOps." Source (read, documented, captured 2026-11-10T15:46Z, sha256 56f5b867d7f837df) · π Moderate · S1·R5·A1 ×3

This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.

Next unlock: level 3, Open protocol. Public evidence that it asks for narrower access than the whole account.

Control: level 1, Stated

Can people stay in command? Documents say how people approve, override or stop it.

• I38 High-impact actions need a person's approval. A merge to the main branch needs a person on the customer's team; AISLE opens the pull request and waits. "it opens the pull request and waits for human approval" Source (read, documented, captured 2026-11-10T15:46Z, sha256 781c682dd9303d6b) · π Moderate · S1·R5·A1 ×3

This evidence touches 6 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft.

Next unlock: level 2, Configurable. Public evidence that what it can reach is enumerated: scopes, permissions, tools.

Openness: level 2, Documented

Does it show its work? Public documents on how it works, its data, its models and its limits.

• I22 Its limits and known failure cases are documented for those who use it. The page states which findings get guidance instead of a patch, and that a fix breaking tests goes back to the team. "When findings can't be safely patched, it provides clear remediation advice instead." Source (read, documented, captured 2026-11-10T15:46Z, sha256 781c682dd9303d6b) · π Moderate · S1·R5·A1 ×3
• I58 The data it uses is described. The privacy policy lists customer data as code repositories and related data submitted to the service. "Code repositories and related data submitted to Services" Source (read, documented, captured 2026-11-10T15:46Z, sha256 13cbb99908547db4) · π Moderate · S1·R5·A1 ×3

This evidence touches 7 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce.

Next unlock: level 3, Measured. Public evidence that test or evaluation results are published.

How far to trust this card

Status: Draft. Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. FACT-Ray says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.

• The facts: 17 facts: 17 π Moderate. Each is written beside its evidence above.
• The chain: found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
• Who: produced by gamma.studio@web-summit.dinis; checked by gamma.review@web-summit.dinis and gamma.approve@web-summit.dinis. The actors.
• What would raise it: the company's own file at /.well-known/fact-ray.json (Source 2), a customer's statement of use (Source 3), or a named person signing the card (how).

The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

The 68 provisions lit

Each line item, with the facts that reach it. "Evidenced" is a link of the kind same: the fact is what the provision asks. "Partly" is a link of the kind part: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.

Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

The vault

Every source behind this card was captured and hashed into a public sgit vault (z11yqwik): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:

sgit_public_read_5dcfc650a15adce6282cb5996d1cd2f57f8bd817588886e419e57a94246fdabd:z11yqwik

With sgit: sgit clone sgit_public_read_5dcfc650a15adce6282cb5996d1cd2f57f8bd817588886e419e57a94246fdabd:z11yqwik.