# Spectrum card: GetVocal AI agents

> GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray Spectrum beta card of GetVocal AI agents: A4 · R2 · C1 · O1, Building; 71 provisions lit across 8 instruments.
> Page: https://gamma-ray.sgit.ai/spectrum/cards/getvocal-agents/ · Source: data/scans/getvocal-agents.json


Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

GetVocal AI's voice, chat, WhatsApp and email agents for enterprise contact centres, built in its Agent Builder and supervised by people through its control console.

GetVocal AI agents a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 R2 Reach Integrated π Moderate · S1·R5·A1 ×3 C1 Control Stated with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 O1 Openness Disclosed π Moderate · S1·R5·A1 ×3 Draft Stage: Building (8 of 16) In production Standout. Autonomy 4 (Orchestrates): "Agents handle voice and chat across your existing stack (CRM, CCaaS, telephony, helpdesk)" Next unlock. Control 2 (Configurable): public evidence that what it can reach is enumerated: scopes, permissions, tools would get there. Trust. FACT-Ray : 20 facts: 20 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 71 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 9 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

*Figure. The walk from the card down to each indicator, its public source and the instruments it touches; the sections below list the same in text.*

## What each level rests on

*Figure. For each dimension, what its level rests on: one fold-out per fact, each opening that fact's path down to the source.*

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by [published rules](../../evidence-map/index.md). A dimension with no evidence reads "not yet evidenced".

## Autonomy: level 4, Orchestrates

*What does the agent do on its own?* Runs multi-step workflows across systems or coordinates other agents; a person sets goals and reviews outcomes. **This level holds with: With human validation nodes.** As shipped, with nothing turned on, it is not yet evidenced.

- `I10` It works across several domains or systems. The llms.txt says the agents work across the customer's CRM, CCaaS, telephony and helpdesk systems. "Agents handle voice and chat across your existing stack (CRM, CCaaS, telephony, helpdesk)" [Source](https://www.getvocal.ai/llms.txt) (read, documented, captured 2026-11-10T15:45Z, sha256 `a24b2369870940e0`) · π Moderate · S1·R5·A1 ×3
- `I18` The agent works independently; the person approves critical decisions only. The Control Tower page says the agent asks a human to approve critical decisions before executing them. "AI proactively asks a human to approve critical decisions before executing them." [Source](https://www.getvocal.ai/control-tower) (read, documented, available, captured 2026-11-10T15:45Z, sha256 `4b0df640abc62a40`) · π Moderate · S1·R5·A1 ×3

This evidence touches 6 provisions: Salesforce, Microsoft, EAAMM.

## Reach: level 2, Integrated

*How connected is it?* Documented connectors to common tools.

- `I10` It works across several domains or systems. The llms.txt says the agents work across the customer's CRM, CCaaS, telephony and helpdesk systems. "Agents handle voice and chat across your existing stack (CRM, CCaaS, telephony, helpdesk)" [Source](https://www.getvocal.ai/llms.txt) (read, documented, captured 2026-11-10T15:45Z, sha256 `a24b2369870940e0`) · π Moderate · S1·R5·A1 ×3
- `I11` It connects to external tools or services across a trust boundary. The handoff payload is described as sent over a REST API to the agent desktop, naming Genesys Cloud and Salesforce integrations. "delivered via bidirectional REST API to the unified agent desktop" [Source](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (read, documented, captured 2026-11-10T15:45Z, sha256 `20a40e83c0c18c04`) · π Moderate · S1·R5·A1 ×3

This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.

**Next unlock: level 4, Ecosystem.** Public evidence that agents operate across organisational boundaries or disparate stacks; and that others build on it: third parties publish integrations, skills or agents for it.

## Control: level 1, Stated

*Can people stay in command?* Documents say how people approve, override or stop it. **This level holds with: With human validation nodes.** As shipped, with nothing turned on, it is not yet evidenced.

- `I38` High-impact actions need a person's approval. llms.txt says high-stakes actions such as large transactions, high-value returns and sensitive data get human-in-the-loop approval. A GetVocal blog on escalation says operators configure, in the Control Tower's Operator View, which decision nodes require validation. "with human-in-the-loop approval on high-stakes actions" [Source](https://www.getvocal.ai/llms.txt) (read, documented, available, captured 2026-11-10T15:45Z, sha256 `a24b2369870940e0`) · π Moderate · S1·R5·A1 ×3

This evidence touches 6 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft.

**Next unlock: level 2, Configurable.** Public evidence that what it can reach is enumerated: scopes, permissions, tools.

## Openness: level 1, Disclosed

*Does it show its work?* Says what it is for, and that it is AI, what its limits are or what data it uses.

- `I20` Its purpose and permitted tasks are stated in writing. The llms.txt says the agents resolve customer conversations end to end inside the customer's business rules, with human approval on high-stakes actions; the Control Tower FAQ says the agent cannot take actions its graph does not contain. "Agents resolve customer conversations end to end while staying inside your business rules" [Source](https://www.getvocal.ai/llms.txt) (read, documented, captured 2026-11-10T15:45Z, sha256 `a24b2369870940e0`) · π Moderate · S1·R5·A1 ×3
- `I56` It tells the people it talks to that it is an AI. In one deployment for an unnamed large Spanish telecom operator, each call opened with a disclosure that the caller was speaking with a virtual assistant. No GetVocal page states that agents disclose they are AI by default or documents a disclosure setting; the EU AI Act blog advises deployers to add a disclosure node. "clear disclosure that the caller was speaking with a virtual assistant" [Source](https://www.getvocal.ai/customers/large-spanish-telecom) (read, documented, available, captured 2026-11-10T15:45Z, sha256 `7395e9c14edfe0e1`) · π Moderate · S1·R5·A1 ×3
- `I58` The data it uses is described. The agents are described as grounded in the customer's call scripts, help documents, CRM records and past transcripts. "a living model of your call scripts, help docs, CRM records and past transcripts" [Source](https://www.getvocal.ai/enterprise-ai-agents) (read, documented, captured 2026-11-10T15:45Z, sha256 `cd7ed09e9b8276c8`) · π Moderate · S1·R5·A1 ×3

This evidence touches 10 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce.

**Next unlock: level 2, Documented.** Public evidence that its limits and known failure cases are documented for those who use it.

## How far to trust this card

**Status: Draft.** Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. [FACT-Ray](../../../fact-ray/index.md) says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.

- **The facts:** 20 facts: 20 π Moderate. Each is written beside its evidence above.
- **The chain:** found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
- **Who:** produced by `gamma.studio@web-summit.dinis`; checked by `gamma.review@web-summit.dinis` and `gamma.approve@web-summit.dinis`. [The actors](../../../fact-ray/actors/index.md).
- **What would raise it:** the company's own file at `/.well-known/fact-ray.json` (Source 2), a customer's statement of use (Source 3), or a named person signing the card ([how](../../../fact-ray/well-known/index.md)).

## The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

| Instrument | Provisions touched | Of those publicly readable |
|---|---|---|
| Salesforce | 14 | 24 |
| EAAMM | 4 | 8 |
| OWASP | 10 | 18 |
| MCP authorization | 2 | 8 |
| AAGMM | 5 | 6 |
| Microsoft | 15 | 23 |
| NIST AI RMF | 15 | 20 |
| EU AI Act | 6 | 6 |

The 71 provisions lit

Each line item, with the facts that reach it. "Evidenced" is a link of the kind *same*: the fact is what the provision asks. "Partly" is a link of the kind *part*: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.

| Provision | Instrument | Reached by | How far |
|---|---|---|---|
| [`sf.a02`](../../../provisions/sf.a02/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I67](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a04`](../../../provisions/sf.a04/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I58](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a06`](../../../provisions/sf.a06/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I67](https://www.getvocal.ai/control-tower) (evidenced), [S1](https://www.getvocal.ai/customers/nicomatic) (partly) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a07`](../../../provisions/sf.a07/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I08](https://www.getvocal.ai/voice) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a08`](../../../provisions/sf.a08/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I58](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a12`](../../../provisions/sf.a12/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I67](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.L2`](../../../provisions/sf.L2/index.md) Level 2: Simple Orchestration, Single Domain | Salesforce | [I08](https://www.getvocal.ai/voice) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a16`](../../../provisions/sf.a16/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I10](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.L3`](../../../provisions/sf.L3/index.md) Level 3: Complex Orchestration, Multiple Domain | Salesforce | [I10](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a17`](../../../provisions/sf.a17/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I10](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a22`](../../../provisions/sf.a22/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I38](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a24`](../../../provisions/sf.a24/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I67](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a27`](../../../provisions/sf.a27/index.md) Level 4, how to maximize value | Salesforce | [I67](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a29`](../../../provisions/sf.a29/index.md) Level 4, how to maximize value | Salesforce | [I67](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.L3`](../../../provisions/eaamm.L3/index.md) L3 Consultative (survey item Q9) | EAAMM | [I17](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.L4`](../../../provisions/eaamm.L4/index.md) L4 Supervisory (survey item Q9) | EAAMM | [I18](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.D2`](../../../provisions/eaamm.D2/index.md) Readiness dimension 2 | EAAMM | [I58](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.G2`](../../../provisions/eaamm.G2/index.md) Prerequisite, L2 to L3 | EAAMM | [I40](https://www.getvocal.ai/voice) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT3`](../../../provisions/owasp.AT3/index.md) AT3 Citizen Developer Agent | OWASP | [I03](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT6`](../../../provisions/owasp.AT6/index.md) AT6 Externally Extended Agent | OWASP | [I11](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k03`](../../../provisions/owasp.k03/index.md) Maturity Level 0 Unaware and Ad Hoc, key enterprise action | OWASP | [I41](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k07`](../../../provisions/owasp.k07/index.md) Maturity Level 1 Experimentation without Guardrails, key enterprise action | OWASP | [I21](https://www.getvocal.ai/blog/eu-ai-act-compliance-customer-service-ai-agents) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k09`](../../../provisions/owasp.k09/index.md) Maturity Level 1 Experimentation without Guardrails, key enterprise action | OWASP | [I41](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k10`](../../../provisions/owasp.k10/index.md) Maturity Level 1 Experimentation without Guardrails, key enterprise action | OWASP | [I68](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k12`](../../../provisions/owasp.k12/index.md) Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action | OWASP | [I38](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k19`](../../../provisions/owasp.k19/index.md) Maturity Level 3 Integrated, Continuous Oversight, key enterprise action | OWASP | [I48](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k22`](../../../provisions/owasp.k22/index.md) Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action | OWASP | [I48](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k26`](../../../provisions/owasp.k26/index.md) Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action | OWASP | [I36](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.01`](../../../provisions/mcp.01/index.md) Authorization (draft) | MCP authorization | [S3](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.02`](../../../provisions/mcp.02/index.md) Authorization (draft) | MCP authorization | [S3](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-03`](../../../provisions/aagmm.GD-03/index.md) GD-03 | AAGMM | [I41](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-05`](../../../provisions/aagmm.GD-05/index.md) GD-05 | AAGMM | [I58](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-06`](../../../provisions/aagmm.GD-06/index.md) GD-06 | AAGMM | [I38](https://www.getvocal.ai/llms.txt) (partly), [I40](https://www.getvocal.ai/voice) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-08`](../../../provisions/aagmm.GD-08/index.md) GD-08 | AAGMM | [I41](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-12`](../../../provisions/aagmm.GD-12/index.md) GD-12 | AAGMM | [I68](https://www.getvocal.ai/enterprise-ai-agents) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.100.3.2`](../../../provisions/ms.100.3.2/index.md) 100: Initial, AI governance and security | Microsoft | [I36](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.100.5.3`](../../../provisions/ms.100.5.3/index.md) 100: Initial, Organization and culture | Microsoft | [I67](https://www.getvocal.ai/control-tower) (its absence) | its absence · π Moderate · S1·R5·A1 ×3 |
| [`ms.200.2.1`](../../../provisions/ms.200.2.1/index.md) 200: Repeatable, Business strategy | Microsoft | [I08](https://www.getvocal.ai/voice) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.200.2.5`](../../../provisions/ms.200.2.5/index.md) 200: Repeatable, Business strategy | Microsoft | [I67](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.200.4.2`](../../../provisions/ms.200.4.2/index.md) 200: Repeatable, Technology and data | Microsoft | [I10](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.300.1.4`](../../../provisions/ms.300.1.4/index.md) 300: Defined, AI strategy and experience | Microsoft | [I67](https://www.getvocal.ai/control-tower) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.300.2.2`](../../../provisions/ms.300.2.2/index.md) 300: Defined, Business strategy | Microsoft | [I67](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.300.2.3`](../../../provisions/ms.300.2.3/index.md) 300: Defined, Business strategy | Microsoft | [I21](https://www.getvocal.ai/blog/eu-ai-act-compliance-customer-service-ai-agents) (partly), [I38](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.1.3`](../../../provisions/ms.400.1.3/index.md) 400: Capable, AI strategy and experience | Microsoft | [I67](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.2.1`](../../../provisions/ms.400.2.1/index.md) 400: Capable, Business strategy | Microsoft | [I10](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.2.3`](../../../provisions/ms.400.2.3/index.md) 400: Capable, Business strategy | Microsoft | [I67](https://www.getvocal.ai/control-tower) (evidenced), [S1](https://www.getvocal.ai/customers/nicomatic) (partly) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.3.2`](../../../provisions/ms.400.3.2/index.md) 400: Capable, AI governance and security | Microsoft | [I68](https://www.getvocal.ai/enterprise-ai-agents) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.500.1.2`](../../../provisions/ms.500.1.2/index.md) 500: Efficient, AI strategy and experience | Microsoft | [I68](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.500.2.2`](../../../provisions/ms.500.2.2/index.md) 500: Efficient, Business strategy | Microsoft | [I68](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.500.3.3`](../../../provisions/ms.500.3.3/index.md) 500: Efficient, AI governance and security | Microsoft | [I48](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-1.1`](../../../provisions/nist.GOVERN-1.1/index.md) GOVERN 1.1 | NIST AI RMF | [I36](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-3.2`](../../../provisions/nist.GOVERN-3.2/index.md) GOVERN 3.2 | NIST AI RMF | [I40](https://www.getvocal.ai/voice) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-6.1`](../../../provisions/nist.GOVERN-6.1/index.md) GOVERN 6.1 | NIST AI RMF | [I11](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MANAGE-4.2`](../../../provisions/nist.MANAGE-4.2/index.md) MANAGE 4.2 | NIST AI RMF | [I68](https://www.getvocal.ai/enterprise-ai-agents) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MANAGE-4.3`](../../../provisions/nist.MANAGE-4.3/index.md) MANAGE 4.3 | NIST AI RMF | [I54](https://status.getvocal.ai/events) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.1`](../../../provisions/nist.MAP-1.1/index.md) MAP 1.1 | NIST AI RMF | [I20](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.3`](../../../provisions/nist.MAP-1.3/index.md) MAP 1.3 | NIST AI RMF | [I20](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.4`](../../../provisions/nist.MAP-1.4/index.md) MAP 1.4 | NIST AI RMF | [I67](https://www.getvocal.ai/control-tower) (partly), [S1](https://www.getvocal.ai/customers/nicomatic) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-2.1`](../../../provisions/nist.MAP-2.1/index.md) MAP 2.1 | NIST AI RMF | [I20](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-2.2`](../../../provisions/nist.MAP-2.2/index.md) MAP 2.2 | NIST AI RMF | [I21](https://www.getvocal.ai/blog/eu-ai-act-compliance-customer-service-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-3.1`](../../../provisions/nist.MAP-3.1/index.md) MAP 3.1 | NIST AI RMF | [I67](https://www.getvocal.ai/control-tower) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-3.3`](../../../provisions/nist.MAP-3.3/index.md) MAP 3.3 | NIST AI RMF | [I20](https://www.getvocal.ai/llms.txt) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-3.5`](../../../provisions/nist.MAP-3.5/index.md) MAP 3.5 | NIST AI RMF | [I38](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-4.1`](../../../provisions/nist.MAP-4.1/index.md) MAP 4.1 | NIST AI RMF | [I11](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MEASURE-4.3`](../../../provisions/nist.MEASURE-4.3/index.md) MEASURE 4.3 | NIST AI RMF | [I68](https://www.getvocal.ai/enterprise-ai-agents) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-12`](../../../provisions/aiact.art-12/index.md) Article 12 | EU AI Act | [I41](https://www.getvocal.ai/blog/ai-agent-escalation-logic-human-handoff) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-13`](../../../provisions/aiact.art-13/index.md) Article 13 | EU AI Act | [I20](https://www.getvocal.ai/llms.txt) (partly), [S3](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-14`](../../../provisions/aiact.art-14/index.md) Article 14 | EU AI Act | [I38](https://www.getvocal.ai/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-26`](../../../provisions/aiact.art-26/index.md) Article 26 | EU AI Act | [I54](https://status.getvocal.ai/events) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-50`](../../../provisions/aiact.art-50/index.md) Article 50 | EU AI Act | [I56](https://www.getvocal.ai/customers/large-spanish-telecom) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-73`](../../../provisions/aiact.art-73/index.md) Article 73 | EU AI Act | [I54](https://status.getvocal.ai/events) (partly) | partly · π Moderate · S1·R5·A1 ×3 |

## Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's [GAMMA-Ray rating](../../../scans/getvocal-agents/index.md): freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

## The vault

Every source behind this card was captured and hashed into a public sgit vault (`qiamk6dj`): `captures.json` lists each URL with the SHA-256 of what was fetched and when. Read key:

`sgit_public_read_b46064eedc934cdbb18761e1da1a30140af1ba5f7bc05ed56a8b7e95e45b44d4:qiamk6dj`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_b46064eedc934cdbb18761e1da1a30140af1ba5f7bc05ed56a8b7e95e45b44d4:qiamk6dj`.