Manus

Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

Manus AI's general agent that plans and carries out tasks for a user in a cloud sandbox, and also through a desktop app, a browser extension and an API.

What each level rests on

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".

Autonomy: level 3, Acts

What does the agent do on its own? Completes routine tasks end to end; a person handles exceptions. This level holds with: Manus Studio, ask for approval; Manus Studio, working locally. As shipped, with nothing turned on, it is not yet evidenced.

• I08 It executes actions itself. The API docs list actions the agent carries out in its task loop, such as sending email, changing calendar events, running terminal commands and deploying a service. This is the API's documentation of the task loop. "tools that the current Manus agent runs in the main task loop" Source (read, documented, captured 2026-11-10T04:59Z, sha256 b51a0a23e9bc2981) · π Moderate · S1·R5·A1 ×3
• I17 The agent handles routine tasks; the person is consulted on exceptions. In Manus Studio the default Approve for me mode auto-approves safe local actions and asks the person when a decision is needed. "Reviews and auto-approves safe local actions." Source (read, documented, available, captured 2026-11-10T04:59Z, sha256 96079a92f854e6e0) · π Moderate · S1·R5·A1 ×3

This evidence touches 4 provisions: Salesforce, Microsoft, EAAMM.

Next unlock: level 4, Orchestrates. Public evidence that the agent works independently; the person approves critical decisions only.

Reach: level 2, Integrated

How connected is it? Documented connectors to common tools.

• I10 It works across several domains or systems. Connectors let the agent read data from and act in apps such as Gmail and Notion once the user connects them. "lets Manus read data from an app, such as Gmail or Notion" Source (read, documented, available, captured 2026-11-10T04:59Z, sha256 f1932af9dccead99) · π Moderate · S1·R5·A1 ×3
• I11 It connects to external tools or services across a trust boundary. The Similarweb data integration is used without setup, the agent fetching metrics from the external service. "Manus automatically connects to Similarweb and retrieves the exact metrics" Source (read, documented, captured 2026-11-10T04:59Z, sha256 f44644af396f1ad0) · π Moderate · S1·R5·A1 ×3

This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.

Next unlock: level 4, Ecosystem. Public evidence that agents operate across organisational boundaries or disparate stacks; and that others build on it: third parties publish integrations, skills or agents for it.

Control: level 1, Stated

Can people stay in command? Documents say how people approve, override or stop it. This level holds with: Through the API. As shipped, with nothing turned on, it is not yet evidenced.

• I38 High-impact actions need a person's approval. The API's confirmation events list action types that wait for the user before they run, among them sending email, deleting calendar events, deploying a service and running a command; the page is for integrators who build their own confirmation interface, does not say when the waits occur in the app, and some types accept global_allow, which skips later ones. "Send, save as draft, or cancel" Source (read, documented, available, captured 2026-11-10T04:59Z, sha256 b51a0a23e9bc2981) · π Moderate · S1·R5·A1 ×3

This evidence touches 6 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft.

Next unlock: level 2, Configurable. Public evidence that what it can reach is enumerated: scopes, permissions, tools.

Openness: level 2, Documented

Does it show its work? Public documents on how it works, its data, its models and its limits. This level holds with: Browser Operator. As shipped, with nothing turned on, it is level 1, Disclosed.

• I22 Its limits and known failure cases are documented for those who use it. The Browser Operator page lists limitations, including complex interactions and sites with anti-bot measures. "Complex interactions, such as drag-and-drop and multi-step forms, may not work perfectly." Source (read, documented, available, captured 2026-11-10T04:59Z, sha256 9c63bdb4aab197d1) · π Moderate · S1·R5·A1 ×3
• I58 The data it uses is described. The sandbox post lists what the task sandbox stores, and the Studio page says what is sent to the cloud. "Your Manus Sandbox stores the files needed during task execution, including" Source (read, documented, captured 2026-11-10T04:59Z, sha256 33be308ad9b32242) · π Moderate · S1·R5·A1 ×3

This evidence touches 7 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce.

Next unlock: level 3, Measured. Public evidence that test or evaluation results are published.

How far to trust this card

Status: Draft. Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. FACT-Ray says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.

• The facts: 18 facts: 18 π Moderate. Each is written beside its evidence above.
• The chain: found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
• Who: produced by gamma.studio@web-summit.dinis; checked by gamma.review@web-summit.dinis and gamma.approve@web-summit.dinis. The actors.
• What would raise it: the company's own file at /.well-known/fact-ray.json (Source 2), a customer's statement of use (Source 3), or a named person signing the card (how).

The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

The 52 provisions lit

Each line item, with the facts that reach it. "Evidenced" is a link of the kind same: the fact is what the provision asks. "Partly" is a link of the kind part: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.

Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

The vault

Every source behind this card was captured and hashed into a public sgit vault (wcvaw1bi): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:

sgit_public_read_5ab82ed8d04719fb9fa7ffa28ef3cbd9eec71b4b03b2958ee62f470c3c1e6ba9:wcvaw1bi

With sgit: sgit clone sgit_public_read_5ab82ed8d04719fb9fa7ffa28ef3cbd9eec71b4b03b2958ee62f470c3c1e6ba9:wcvaw1bi.