BETA · GAMMA-Ray is published for review. The rules, the mapping and every rating here are experimental and will change. How a rating is made · what exists · send a correction
GAMMA-Rayv0.0.21 · beta

GitHub Copilot cloud agent

Spectrum 0.1 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

The asynchronous agent on GitHub.com that creates branches, writes code and opens pull requests in response to assigned issues.

GitHub Copilot cloud agenta product, as documented
SPECTRUM 0.1 BETA · Public tier · 2026-11-10
A·Autonomynot yet evidenced
R2ReachIntegrated (available)
C2ControlConfigurable
O1OpennessDisclosed
Stage: Exploring (5 of 16)

Standout. Reach 2 (Integrated): "external applications like Microsoft Teams, Linear, Slack, and Jira"

Next unlock. Autonomy 3 (Acts): public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own would get there.

Standards constellation. 44 provisions lit across 8 of 8 instruments.

Salesforce
EAAMM
OWASP
MCP
AAGMM
Microsoft
NIST
AI Act

Evidence: 3 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

The card: GitHub Copilot cloud agentGitHub Copilot cloud agent: A0 · R2 · C2 · O1, ExploringAutonomy: not yet evidenced (this card's section)A·AutonomyNothing public found yet. Not a no.Reach: level 2, Integrated (this card's section)R2ReachI10, answers Q03: How far does it reach? (the questions page)I10It works across several domains orsystemsEvidence: https://docs.github.com/en/copilot/responsible-use/copilot-coding-agent (opens the public source; documented, available, captured 2026-11-10T03:32Z)docs.github.com/en/copilot/responsib… ↗documented · available · sha256 4c556dc53 provisions of Salesforce Agentic Maturity Model (the instruments page)Salesforce 32 provisions of Agentic AI adoption maturity model (the instruments page)Microsoft 2I11, answers Q03: How far does it reach? (the questions page)I11It connects to external tools or servicesacross a trust boundaryEvidence: https://docs.github.com/en/copilot/concepts/agents/coding-agent/mcp-and-coding-agent (opens the public source; documented, available, captured 2026-11-10T03:32Z)docs.github.com/en/copilot/concepts/… ↗documented · available · sha256 e0ab793e1 provision of State of Agentic AI Security and Governance 2.01 (the instruments page)OWASP 12 provisions of AI Risk Management Framework 1.0, subcategories (the instruments page)NIST AI RMF 2Control: level 2, Configurable (this card's section)C2ControlI38, answers Q11: Can a person step in or stop it? (the questions page)I38High-impact actions need a person'sapprovalEvidence: https://docs.github.com/en/copilot/responsible-use/copilot-coding-agent (opens the public source; documented, default, captured 2026-11-10T03:32Z)docs.github.com/en/copilot/responsib… ↗documented · default · sha256 4c556dc51 provision of State of Agentic AI Security and Governance 2.01 (the instruments page)OWASP 11 provision of Regulation (EU) 2024/1689 (the AI Act), selected articles (the instruments page)EU AI Act 11 provision of Agentic AI Governance Maturity Model (AAGMM) (the instruments page)AAGMM 11 provision of AI Risk Management Framework 1.0, subcategories (the instruments page)NIST AI RMF 11 provision of Salesforce Agentic Maturity Model (the instruments page)Salesforce 11 provision of Agentic AI adoption maturity model (the instruments page)Microsoft 1I25, answers Q07: Does it have its own identity and only the access it needs? (the questions page)I25It asks for narrower access than thewhole accountEvidence: https://docs.github.com/en/copilot/responsible-use/copilot-coding-agent (opens the public source; documented, default, captured 2026-11-10T03:32Z)docs.github.com/en/copilot/responsib… ↗documented · default · sha256 4c556dc52 provisions of Model Context Protocol, Authorization (draft) (the instruments page)MCP 22 provisions of Salesforce Agentic Maturity Model (the instruments page)Salesforce 21 provision of Agentic AI Governance Maturity Model (AAGMM) (the instruments page)AAGMM 1Openness: level 1, Disclosed (this card's section)O1OpennessI56, answers Q17: Do people know it is an AI, and can they answer back? (the questions page)I56It tells the people it talks to that itis an AIEvidence: https://docs.github.com/en/copilot/responsible-use/copilot-coding-agent (opens the public source; documented, default, captured 2026-11-10T03:32Z)docs.github.com/en/copilot/responsib… ↗documented · default · sha256 4c556dc51 provision of Regulation (EU) 2024/1689 (the AI Act), selected articles (the instruments page)EU AI Act 1I20, answers Q06: Is what it is for written down? (the questions page)I20Its purpose and permitted tasks arestated in writingEvidence: https://docs.github.com/en/copilot/responsible-use/copilot-coding-agent (opens the public source; documented, default, captured 2026-11-10T03:32Z)docs.github.com/en/copilot/responsib… ↗documented · default · sha256 4c556dc54 provisions of AI Risk Management Framework 1.0, subcategories (the instruments page)NIST AI RMF 41 provision of Regulation (EU) 2024/1689 (the AI Act), selected articles (the instruments page)EU AI Act 1

The walk down from this card: each dimension, the indicators its level stands on (a link to the question), the public source of each answer (a link out; dashed means available, not default) and the instruments its provisions sit in (a link to the instrument). A solid frame is evidenced; a dashed frame is not yet evidenced, which is not a no.

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".

Autonomy: not yet evidenced

What does the agent do on its own? Nothing public was found that meets a rule in this dimension. That is not a no.

Next unlock: level 3, Acts. Public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own.

Reach: level 2, Integrated

How connected is it? Documented connectors to common tools.

This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.

Next unlock: level 4, Ecosystem. Public evidence that agents operate across organisational boundaries or disparate stacks.

Control: level 2, Configurable

Can people stay in command? Approval modes, permission scopes and roles are documented settings.

This evidence touches 11 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft, MCP authorization.

Next unlock: level 3, Observable. Public evidence that there is a way to pause or stop it; and that it is monitored in operation.

Openness: level 1, Disclosed

Does it show its work? Says it is AI and what it is for.

This evidence touches 6 provisions: EU AI Act, NIST AI RMF.

Next unlock: level 2, Documented. Public evidence that the data it uses is described.

The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

InstrumentProvisions touchedOf those publicly readable
Salesforce1024
EAAMM18
OWASP717
MCP authorization48
AAGMM56
Microsoft423
NIST AI RMF920
EU AI Act46

Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

The vault

Every source behind this card was captured and hashed into a public sgit vault (q7vudzvh): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:

sgit_public_read_5681b4b6d6b4524d74282e9e1339326d0663f6d878b790be49cd3b1de028a63e:q7vudzvh

With sgit: sgit clone sgit_public_read_5681b4b6d6b4524d74282e9e1339326d0663f6d878b790be49cd3b1de028a63e:q7vudzvh.