BETA · GAMMA-Ray is published for review. The rules, the mapping and every rating here are experimental and will change. How a rating is made · what exists · send a correction
GAMMA-Rayv0.0.21 · beta

Claude Code on the web

Spectrum 0.1 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

The same coding agent in a cloud session: a managed container with one repository attached and a proxy above it.

Claude Code on the weba product, as documented
SPECTRUM 0.1 BETA · Public tier · 2026-11-10
A·Autonomynot yet evidenced
R2ReachIntegrated
C·Controlnot yet evidenced
O2OpennessDocumented
Stage: Exploring (4 of 16)

Standout. Reach 2 (Integrated): the repository, the shell and the code host

Next unlock. Autonomy 3 (Acts): public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own would get there.

Standards constellation. 42 provisions lit across 8 of 8 instruments.

Salesforce
EAAMM
OWASP
MCP
AAGMM
Microsoft
NIST
AI Act

Evidence: 9 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

The card: Claude Code on the webClaude Code on the web: A0 · R2 · C0 · O2, ExploringAutonomy: not yet evidenced (this card's section)A·AutonomyNothing public found yet. Not a no.Reach: level 2, Integrated (this card's section)R2ReachI10, answers Q03: How far does it reach? (the questions page)I10It works across several domains orsystemsEvidence: https://code.claude.com/docs/en/claude-code-on-the-web (opens the public source; documented, default, captured 2026-11-10T03:32Z)code.claude.com/docs/en/claude-code-… ↗documented · default · sha256 1fdec1c73 provisions of Salesforce Agentic Maturity Model (the instruments page)Salesforce 32 provisions of Agentic AI adoption maturity model (the instruments page)Microsoft 2I11, answers Q03: How far does it reach? (the questions page)I11It connects to external tools or servicesacross a trust boundaryEvidence: https://code.claude.com/docs/en/cloud-environments (opens the public source; documented, default, captured 2026-11-10T03:32Z)code.claude.com/docs/en/cloud-enviro… ↗documented · default · sha256 e62f7d621 provision of State of Agentic AI Security and Governance 2.01 (the instruments page)OWASP 12 provisions of AI Risk Management Framework 1.0, subcategories (the instruments page)NIST AI RMF 2Control: not yet evidenced (this card's section)C·ControlNothing public found yet. Not a no.Openness: level 2, Documented (this card's section)O2OpennessI58, answers Q18: What data does it use, and under what rules? (the questions page)I58The data it uses is describedEvidence: https://code.claude.com/docs/en/data-usage (opens the public source; documented, default, captured 2026-11-10T03:32Z)code.claude.com/docs/en/data-usage ↗documented · default · sha256 96ab27371 provision of Agentic AI Governance Maturity Model (AAGMM) (the instruments page)AAGMM 11 provision of Enterprise Agentic AI Maturity Model (EAAMM) (the instruments page)EAAMM 12 provisions of Salesforce Agentic Maturity Model (the instruments page)Salesforce 2I61, answers Q19: What does it depend on from others? (the questions page)I61The models and third-party components ituses are listedEvidence: https://code.claude.com/docs/en/model-config (opens the public source; documented, default)code.claude.com/docs/en/model-config ↗documented · default1 provision of State of Agentic AI Security and Governance 2.01 (the instruments page)OWASP 11 provision of AI Risk Management Framework 1.0, subcategories (the instruments page)NIST AI RMF 1

The walk down from this card: each dimension, the indicators its level stands on (a link to the question), the public source of each answer (a link out; dashed means available, not default) and the instruments its provisions sit in (a link to the instrument). A solid frame is evidenced; a dashed frame is not yet evidenced, which is not a no.

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".

Autonomy: not yet evidenced

What does the agent do on its own? Nothing public was found that meets a rule in this dimension. That is not a no.

Next unlock: level 3, Acts. Public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own.

Reach: level 2, Integrated

How connected is it? Documented connectors to common tools.

This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.

Next unlock: level 3, Open protocol. Public evidence that there is a published protocol or communication layer between agents.

Control: not yet evidenced

Can people stay in command? Nothing public was found that meets a rule in this dimension. That is not a no.

Next unlock: level 1, Stated. Public evidence that a limit on it is a rule in prose.

Openness: level 2, Documented

Does it show its work? Public documents on how it works, its data, its models and its limits.

This evidence touches 6 provisions: AAGMM, EAAMM, Salesforce, OWASP, NIST AI RMF.

Also evidenced: the rule for level 4. It will count when the level before it is.

Next unlock: level 3, Measured. Public evidence that test or evaluation results are published.

The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

InstrumentProvisions touchedOf those publicly readable
Salesforce1024
EAAMM28
OWASP617
MCP authorization68
AAGMM46
Microsoft523
NIST AI RMF720
EU AI Act26

Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

The vault

Every source behind this card was captured and hashed into a public sgit vault (kq47p50t): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:

sgit_public_read_8996af6ecc712b76dfb7a34f4b820d2e89d066ade22bf910e02b7a5ea39d9fdc:kq47p50t

With sgit: sgit clone sgit_public_read_8996af6ecc712b76dfb7a34f4b820d2e89d066ade22bf910e02b7a5ea39d9fdc:kq47p50t.