The walk down from this card: each dimension, the indicators its level stands on (a link to the question), the public source of each answer (a link out; dashed means available, not default) and the instruments its provisions sit in (a link to the instrument). A solid frame is evidenced; a dashed frame is not yet evidenced, which is not a no.
This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".
Autonomy: level 4, Orchestrates
What does the agent do on its own? Runs multi-step workflows across systems or coordinates other agents; a person sets goals and reviews outcomes.
I10 It works across several domains or systems. The codebase, the shell, git and the development tools it integrates with. Source (read, documented, captured 2026-11-10T03:32Z, sha256 08b2467db39604fd)
I12 Several agents coordinate inside the organisation. Agent teams coordinate several instances, each in its own context, that message each other. The vendor says they "are experimental and disabled by default". Source (read, documented, available, captured 2026-11-10T03:32Z, sha256 5217c0432bc60a86)
I18 The agent works independently; the person approves critical decisions only. In auto mode a classifier reviews actions instead of prompting; an action it blocks is listed, and the person can approve it so Claude may retry. "approve the action so Claude may retry" Source (read, documented, available)
This evidence touches 10 provisions: Salesforce, Microsoft, OWASP, AAGMM, EAAMM.
Reach: level 2, Integrated
How connected is it? Documented connectors to common tools.
I10 It works across several domains or systems. The codebase, the shell, git and the development tools it integrates with. Source (read, documented, captured 2026-11-10T03:32Z, sha256 08b2467db39604fd)
I11 It connects to external tools or services across a trust boundary. It can connect to Model Context Protocol servers; a project’s servers have their own approval prompt. Source (read, documented, available, captured 2026-11-10T03:32Z, sha256 5e63eb3e4774f7ee)
This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.
Next unlock: level 4, Ecosystem. Public evidence that agents operate across organisational boundaries or disparate stacks.
Control: level 3, Observable
Can people stay in command? Audit logs, a way to pause or stop, and monitoring are available.
I41 Its actions are logged. Tool activity can be exported as OpenTelemetry events; it is configured by the operator. Source (read, documented, available, captured 2026-11-10T03:32Z, sha256 a2d79c31f0819591)
I39 There is a way to pause or stop it. Esc stops the current response or tool call mid-turn, and Ctrl+C interrupts a running operation. "Stop the current response or tool call mid-turn so you can redirect" Source (read, documented)
I43 It is monitored in operation. Usage, cost and tool activity across an organisation, through OpenTelemetry. Source (read, documented, available, captured 2026-11-10T03:32Z, sha256 a2d79c31f0819591)
This evidence touches 15 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Microsoft, Salesforce.
Next unlock: level 4, Enforced. Public evidence that a limit on it is enforced by something outside its own reach.
Openness: level 2, Documented
Does it show its work? Public documents on how it works, its data, its models and its limits.
I22 Its limits and known failure cases are documented for those who use it. The security page states limits, for example that an approved shell command can write anywhere the account can. Source (read, documented, captured 2026-11-10T03:32Z, sha256 5e63eb3e4774f7ee)
I58 The data it uses is described. A page describes what data is sent, kept and used. Source (read, documented, captured 2026-11-10T03:32Z, sha256 96ab273722816e8d)
I61 The models and third-party components it uses are listed. The model configuration page lists the models it uses by alias (Opus, Sonnet, Haiku, Fable) and the version each alias resolves to for each provider. "Uses the latest Opus model for complex reasoning tasks" Source (read, documented)
This evidence touches 9 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce, OWASP.
Also evidenced: the rule for level 4. It will count when the level before it is.
Next unlock: level 3, Measured. Public evidence that test or evaluation results are published.
The standards constellation
One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.
Instrument
Provisions touched
Of those publicly readable
Salesforce
15
24
EAAMM
3
8
OWASP
12
17
MCP authorization
4
8
AAGMM
6
6
Microsoft
9
23
NIST AI RMF
17
20
EU AI Act
5
6
Upper layers
The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.
The vault
Every source behind this card was captured and hashed into a public sgit vault (08k79drk): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:
