# Spectrum card: AI Grant Consultant > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray Spectrum beta card of AI Grant Consultant: A2 · R1 · C1 · O1, Exploring; 35 provisions lit across 7 instruments. > Page: https://gamma-ray.sgit.ai/spectrum/cards/granter-ai-grant-consultant/ · Source: data/scans/granter-ai-grant-consultant.json Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet Chat-based agent, onboarded with the organisation's details and past applications, that matches funding calls, checks eligibility and admissibility, drafts applications section by section with playbooks, scores drafts with an Evaluator, and supports post-approval reporting. The user submits the application. AI Grant Consultant a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A2 Autonomy Suggests π Moderate · S1·R5·A1 ×3 R1 Reach Contained π Moderate · S1·R5·A1 ×3 C1 Control Stated π Moderate · S1·R5·A1 ×3 O1 Openness Disclosed π Moderate · S1·R5·A1 ×3 Draft Stage: Exploring (5 of 16) In production Balanced Standout. Autonomy 2 (Suggests): "Users review and approve them before any submission or decision" Next unlock. Reach 2 (Integrated): public evidence that it works across several domains or systems would get there. Trust. FACT-Ray : 10 facts: 10 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 35 provisions lit across 7 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 4 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card *Figure. The walk from the card down to each indicator, its public source and the instruments it touches; the sections below list the same in text.* ## What each level rests on *Figure. For each dimension, what its level rests on: one fold-out per fact, each opening that fact's path down to the source.* This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by [published rules](../../evidence-map/index.md). A dimension with no evidence reads "not yet evidenced". ## Autonomy: level 2, Suggests *What does the agent do on its own?* Uses tools and data, proposes actions; a person approves each one. - `I16` The agent suggests; the person reviews and approves each action. The privacy policy, which covers the whole Granter platform and does not name the agent, says the platform's AI search, drafts, analyses and recommendations are suggestions that users review and approve before any submission or decision; it does not say each step is approved separately. "Users review and approve them before any submission or decision" [Source](https://granter.ai/privacy-policy) (read, documented, captured 2026-11-10T19:45Z, sha256 `278075589d6cb147`) · π Moderate · S1·R5·A1 ×3 - `I07` It retrieves information and recommends actions; a person acts. The product page says the agent finds calls, checks eligibility and runs an Evaluator that shows what to improve; the user selects the opportunity and makes the submission. "shows what to improve before you submit" [Source](https://granter.ai/blog/ai-grant-consultant) (read, documented, captured 2026-11-10T19:45Z, sha256 `939ffa1a99921ceb`) · π Moderate · S1·R5·A1 ×3 This evidence touches 3 provisions: EAAMM, Salesforce. **Next unlock: level 3, Acts.** Public evidence that it executes actions itself; and that the agent handles routine tasks; the person is consulted on exceptions. ## Reach: level 1, Contained *How connected is it?* Works inside its own product. - `I09` It works in one domain's data. The agent works in one domain: public and private funding calls at regional, national and EU level. "covers both public and private funding, at regional, national and EU level" [Source](https://granter.ai/blog/ai-grant-consultant) (read, documented, captured 2026-11-10T19:45Z, sha256 `939ffa1a99921ceb`) · π Moderate · S1·R5·A1 ×3 This evidence touches 2 provisions: Salesforce. **Next unlock: level 2, Integrated.** Public evidence that it works across several domains or systems. ## Control: level 1, Stated *Can people stay in command?* Documents say how people approve, override or stop it. - `I38` High-impact actions need a person's approval. The product page's FAQ says Granter does not submit the application: the user makes the final submission on the funding platform, since access to submission-platform accounts is restricted for Granter; this states who submits, a structural limit on the product, not an approval step. "The final submission is done by you on the relevant platform" [Source](https://granter.ai/blog/ai-grant-consultant) (read, documented, captured 2026-11-10T19:45Z, sha256 `939ffa1a99921ceb`) · π Moderate · S1·R5·A1 ×3 This evidence touches 6 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft. **Next unlock: level 2, Configurable.** Public evidence that what it can reach is enumerated: scopes, permissions, tools. ## Openness: level 1, Disclosed *Does it show its work?* Says what it is for, and that it is AI, what its limits are or what data it uses. - `I20` Its purpose and permitted tasks are stated in writing. The product page states the agent's purpose and tasks: find the calls an organisation qualifies for, check eligibility, draft the application against the call's criteria, review it, and manage reporting after approval; its FAQ says the agent does not submit. "It finds the calls you qualify for, drafts the application against the official criteria" [Source](https://granter.ai/blog/ai-grant-consultant) (read, documented, captured 2026-11-10T19:45Z, sha256 `939ffa1a99921ceb`) · π Moderate · S1·R5·A1 ×3 - `I56` It tells the people it talks to that it is an AI. The privacy policy states that AI-generated content is labelled as such inside the platform; it is a label on generated content, not a statement about disclosure in conversation. "AI-generated content is presented as such inside the platform." [Source](https://granter.ai/privacy-policy) (read, documented, captured 2026-11-10T19:45Z, sha256 `278075589d6cb147`) · π Moderate · S1·R5·A1 ×3 - `I58` The data it uses is described. In a quote on the product page, Granter's CTO says onboarding collects the organisation's information, such as previous applications and institutional data, which the page says the agent then holds as context (vendor's statement). "collect all important information, like previous applications, institutional data" [Source](https://granter.ai/blog/ai-grant-consultant) (read, documented, captured 2026-11-10T19:45Z, sha256 `939ffa1a99921ceb`) · π Moderate · S1·R5·A1 ×3 This evidence touches 10 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce. **Next unlock: level 2, Documented.** Public evidence that its limits and known failure cases are documented for those who use it. ## How far to trust this card **Status: Draft.** Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. [FACT-Ray](../../../fact-ray/index.md) says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level. - **The facts:** 10 facts: 10 π Moderate. Each is written beside its evidence above. - **The chain:** found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. - **Who:** produced by `gamma.studio@web-summit.dinis`; checked by `gamma.review@web-summit.dinis` and `gamma.approve@web-summit.dinis`. [The actors](../../../fact-ray/actors/index.md). - **What would raise it:** the company's own file at `/.well-known/fact-ray.json` (Source 2), a customer's statement of use (Source 3), or a named person signing the card ([how](../../../fact-ray/well-known/index.md)). ## The standards constellation One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside. | Instrument | Provisions touched | Of those publicly readable | |---|---|---| | Salesforce | 12 | 24 | | EAAMM | 2 | 8 | | OWASP | 1 | 18 | | MCP authorization | 0 | 8 | | AAGMM | 2 | 6 | | Microsoft | 7 | 23 | | NIST AI RMF | 8 | 20 | | EU AI Act | 3 | 6 | The 35 provisions lit Each line item, with the facts that reach it. "Evidenced" is a link of the kind *same*: the fact is what the provision asks. "Partly" is a link of the kind *part*: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source. | Provision | Instrument | Reached by | How far | |---|---|---|---| | [`sf.a01`](../../../provisions/sf.a01/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I07](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a02`](../../../provisions/sf.a02/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I67](https://granter.ai/case-studies/marinha) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a04`](../../../provisions/sf.a04/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I09](https://granter.ai/blog/ai-grant-consultant) (partly), [I58](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a06`](../../../provisions/sf.a06/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I67](https://granter.ai/case-studies/marinha) (evidenced), [S1](https://granter.ai/case-studies/superbock) (partly) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`sf.L1`](../../../provisions/sf.L1/index.md) Level 1: Information Retrieval Agents | Salesforce | [I07](https://granter.ai/blog/ai-grant-consultant) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`sf.a08`](../../../provisions/sf.a08/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I58](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a12`](../../../provisions/sf.a12/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I67](https://granter.ai/case-studies/marinha) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`sf.L2`](../../../provisions/sf.L2/index.md) Level 2: Simple Orchestration, Single Domain | Salesforce | [I09](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a22`](../../../provisions/sf.a22/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I38](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a24`](../../../provisions/sf.a24/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I67](https://granter.ai/case-studies/marinha) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`sf.a27`](../../../provisions/sf.a27/index.md) Level 4, how to maximize value | Salesforce | [I67](https://granter.ai/case-studies/marinha) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`sf.a29`](../../../provisions/sf.a29/index.md) Level 4, how to maximize value | Salesforce | [I67](https://granter.ai/case-studies/marinha) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`eaamm.L2`](../../../provisions/eaamm.L2/index.md) L2 Collaborative (survey item Q9) | EAAMM | [I16](https://granter.ai/privacy-policy) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`eaamm.D2`](../../../provisions/eaamm.D2/index.md) Readiness dimension 2 | EAAMM | [I58](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`owasp.k12`](../../../provisions/owasp.k12/index.md) Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action | OWASP | [I38](https://granter.ai/blog/ai-grant-consultant) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`aagmm.GD-05`](../../../provisions/aagmm.GD-05/index.md) GD-05 | AAGMM | [I58](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`aagmm.GD-06`](../../../provisions/aagmm.GD-06/index.md) GD-06 | AAGMM | [I38](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`ms.100.5.3`](../../../provisions/ms.100.5.3/index.md) 100: Initial, Organization and culture | Microsoft | [I67](https://granter.ai/case-studies/marinha) (its absence) | its absence · π Moderate · S1·R5·A1 ×3 | | [`ms.200.2.5`](../../../provisions/ms.200.2.5/index.md) 200: Repeatable, Business strategy | Microsoft | [I67](https://granter.ai/case-studies/marinha) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`ms.300.1.4`](../../../provisions/ms.300.1.4/index.md) 300: Defined, AI strategy and experience | Microsoft | [I67](https://granter.ai/case-studies/marinha) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`ms.300.2.2`](../../../provisions/ms.300.2.2/index.md) 300: Defined, Business strategy | Microsoft | [I67](https://granter.ai/case-studies/marinha) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`ms.300.2.3`](../../../provisions/ms.300.2.3/index.md) 300: Defined, Business strategy | Microsoft | [I38](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`ms.400.1.3`](../../../provisions/ms.400.1.3/index.md) 400: Capable, AI strategy and experience | Microsoft | [I67](https://granter.ai/case-studies/marinha) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`ms.400.2.3`](../../../provisions/ms.400.2.3/index.md) 400: Capable, Business strategy | Microsoft | [I67](https://granter.ai/case-studies/marinha) (evidenced), [S1](https://granter.ai/case-studies/superbock) (partly) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-1.1`](../../../provisions/nist.MAP-1.1/index.md) MAP 1.1 | NIST AI RMF | [I20](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-1.3`](../../../provisions/nist.MAP-1.3/index.md) MAP 1.3 | NIST AI RMF | [I20](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-1.4`](../../../provisions/nist.MAP-1.4/index.md) MAP 1.4 | NIST AI RMF | [I67](https://granter.ai/case-studies/marinha) (partly), [S1](https://granter.ai/case-studies/superbock) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-2.1`](../../../provisions/nist.MAP-2.1/index.md) MAP 2.1 | NIST AI RMF | [I20](https://granter.ai/blog/ai-grant-consultant) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-3.1`](../../../provisions/nist.MAP-3.1/index.md) MAP 3.1 | NIST AI RMF | [I67](https://granter.ai/case-studies/marinha) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-3.3`](../../../provisions/nist.MAP-3.3/index.md) MAP 3.3 | NIST AI RMF | [I20](https://granter.ai/blog/ai-grant-consultant) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`nist.MAP-3.5`](../../../provisions/nist.MAP-3.5/index.md) MAP 3.5 | NIST AI RMF | [I38](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`nist.MEASURE-1.3`](../../../provisions/nist.MEASURE-1.3/index.md) MEASURE 1.3 | NIST AI RMF | [I52](https://granter.ai/case-studies/marinha) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | | [`aiact.art-13`](../../../provisions/aiact.art-13/index.md) Article 13 | EU AI Act | [I20](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`aiact.art-14`](../../../provisions/aiact.art-14/index.md) Article 14 | EU AI Act | [I38](https://granter.ai/blog/ai-grant-consultant) (partly) | partly · π Moderate · S1·R5·A1 ×3 | | [`aiact.art-50`](../../../provisions/aiact.art-50/index.md) Article 50 | EU AI Act | [I56](https://granter.ai/privacy-policy) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 | ## Upper layers The public card is the front door. The same evidence, read with the governance rules, is this agent's [GAMMA-Ray rating](../../../scans/granter-ai-grant-consultant/index.md): freedom, governance, the level held, the grant and a work order. That layer is written for an operator. ## The vault Every source behind this card was captured and hashed into a public sgit vault (`8fffssyc`): `captures.json` lists each URL with the SHA-256 of what was fetched and when. Read key: `sgit_public_read_d27a5608316451eb20fa628b9943960a7bc8a33709127d6c373b26afca8aeb4e:8fffssyc` With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_d27a5608316451eb20fa628b9943960a7bc8a33709127d6c373b26afca8aeb4e:8fffssyc`.