# GAMMA-Ray Spectrum

> GAMMA-Ray v0.0.21 (beta, for review; every rating is experimental). The public front door of GAMMA-Ray: a positive card for an agentic product, four dimensions by four levels, read only from public evidence, with every level computed from published rules.
> Page: https://gamma-ray.sgit.ai/spectrum/ · Source: content/spectrum/index.md

Spectrum 0.1 beta · published for review · a working name

# What an agent can do, and how openly it shows it.

A Spectrum card describes one agentic product by its shape: four dimensions, four levels each, read only from what is public. Every level is something a company can point at. Nothing on a card is a judgement: each level is computed from evidence by a published rule.

RiskMandate Publisher a deployment SPECTRUM 0.1 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates R2 Reach Integrated C2 Control Configurable O1 Openness Disclosed Stage: Building (9 of 16) Standout. Autonomy 4 (Orchestrates): the repository, the stories vault and the live site Next unlock. Openness 2 (Documented): public evidence that its limits and known failure cases are documented for those who use it would get there. Standards constellation. 73 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 6 sources, captured and hashed · the card's page has the vault's read key · A participant entry: one of our own agents · send a correction The PrompTugal.news agent team a deployment SPECTRUM 0.1 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates R2 Reach Integrated C3 Control Observable O1 Openness Disclosed Stage: Scaling (10 of 16) Standout. Autonomy 4 (Orchestrates): the repository, the vaults, the inboxes and the live site Next unlock. Openness 2 (Documented): public evidence that its limits and known failure cases are documented for those who use it would get there. Standards constellation. 91 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 10 sources, captured and hashed · the card's page has the vault's read key · A participant entry: one of our own agents · send a correction Claude Code on the web a product, as documented SPECTRUM 0.1 BETA · Public tier · 2026-11-10 A · Autonomy not yet evidenced R2 Reach Integrated C · Control not yet evidenced O2 Openness Documented Stage: Exploring (4 of 16) Standout. Reach 2 (Integrated): the repository, the shell and the code host Next unlock. Autonomy 3 (Acts): public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own would get there. Standards constellation. 42 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 9 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card Claude Code, on your own machine a product, as documented SPECTRUM 0.1 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates (available) R2 Reach Integrated (available) C3 Control Observable (available) O2 Openness Documented Stage: Scaling (11 of 16) Standout. Autonomy 4 (Orchestrates): "approve the action so Claude may retry" Next unlock. Reach 4 (Ecosystem): public evidence that agents operate across organisational boundaries or disparate stacks would get there. Standards constellation. 71 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 15 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card GitHub Copilot cloud agent a product, as documented SPECTRUM 0.1 BETA · Public tier · 2026-11-10 A · Autonomy not yet evidenced R2 Reach Integrated (available) C2 Control Configurable O1 Openness Disclosed Stage: Exploring (5 of 16) Standout. Reach 2 (Integrated): "external applications like Microsoft Teams, Linear, Slack, and Jira" Next unlock. Autonomy 3 (Acts): public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own would get there. Standards constellation. 44 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 3 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

These first 5 are our own two agents and three widely used products. A standard is tried on its authors first.

## Four dimensions, four levels

Two dimensions measure agentic **power** and two measure agentic **trust**. No dimension caps another. A dimension with no evidence reads "not yet evidenced", never zero.

| Dimension | The question | Level 1 | Level 2 | Level 3 | Level 4 |
|---|---|---|---|---|---|
| **Autonomy** (power) | What does the agent do on its own? | **Assists**: answers, drafts, summarises; a person does each step | **Suggests**: uses tools and data, proposes actions; a person approves each one | **Acts**: completes routine tasks end to end in production; a person handles exceptions | **Orchestrates**: runs multi-step workflows across systems or coordinates other agents; a person sets goals and reviews outcomes |
| **Reach** (power) | How connected is it? | **Contained**: works inside its own product | **Integrated**: documented connectors to common tools | **Open protocol**: a published agent interface with documented authorisation | **Ecosystem**: others build on it |
| **Control** (trust) | Can people stay in command? | **Stated**: documents say how people approve, override or stop it | **Configurable**: approval modes, permission scopes and roles are documented settings | **Observable**: audit logs, a way to pause or stop, and monitoring are available | **Enforced**: limits enforced outside the agent, described in public |
| **Openness** (trust) | Does it show its work? | **Disclosed**: says it is AI and what it is for | **Documented**: public documents on how it works, its data, its models and its limits | **Measured**: publishes evaluations, and a way to report problems or read it by machine | **Verified**: an independent party has checked it |

Levels three and four need artefacts, not adjectives: a page, an address that resolves, a case study that names a customer, a report. Marketing, roadmaps and demonstrations are "announced": shown, and never counted.

- [The evidence map](evidence-map/index.md): each of the sixteen cells as a rule over indicators.
- [The pipeline](pipeline/index.md): how a card is made, and what a person still does.
- [What the rules did on real evidence](findings/index.md): where they held and where they broke.

## The card

- **The signature** (for example A3 · R3 · C2 · O3) leads, so a product is described by its shape and not by one number.
- **The stage** is the sum of the four levels:

| Stage | Sum of the four levels | Reads as |
|---|---|---|
| **Exploring** | 1 to 5 | Agentic features are live and documented |
| **Building** | 6 to 9 | Agents do real work, with controls taking shape |
| **Scaling** | 10 to 13 | Agents act in production, connect openly, show their work |
| **Pioneering** | 14 to 16 | Sets the bar others in the sector measure against |

- **Badges** are added, and never taken away for something missing:

| Badge | Earned when |
|---|---|
| **Balanced** | Control and Openness are each at least Autonomy minus one |
| **Open protocol** | Reach is level 3 or higher |
| **Shows its work** | Openness is level 3 or higher, with published evaluations |
| **Verified** | Openness reaches level 4 on an independent party’s evidence |
| **Rising** | Moved up at least one level since the previous edition |
| **Claimed** | The company reviewed the card and added evidence |

- **The next unlock** is the one piece of public evidence that would move a level.
- **The standards constellation** is the number of provisions, in each instrument, that the card's evidence touches. "Touched" never means "complies".

## The cards so far

| Card | Signature | Stage | Badges | Provisions lit | Next unlock |
|---|---|---|---|---|---|
| [RiskMandate Publisher](../spectrum/cards/riskmandate-publisher/index.md) | A4 · R2 · C2 · O1 | Building (9) | none yet | 73 in 8 instruments | Openness 2 |
| [The PrompTugal.news agent team](../spectrum/cards/promptugal-newsroom-team/index.md) | A4 · R2 · C3 · O1 | Scaling (10) | none yet | 91 in 8 instruments | Openness 2 |
| [Claude Code on the web](../spectrum/cards/claude-code-web/index.md) | A0 · R2 · C0 · O2 | Exploring (4) | none yet | 42 in 8 instruments | Autonomy 3 |
| [Claude Code, on your own machine](../spectrum/cards/claude-code-local/index.md) | A4 · R2 · C3 · O2 | Scaling (11) | none yet | 71 in 8 instruments | Reach 4 |
| [GitHub Copilot cloud agent](../spectrum/cards/github-copilot-cloud-agent/index.md) | A0 · R2 · C2 · O1 | Exploring (5) | none yet | 44 in 8 instruments | Autonomy 3 |

## The layers

The public card is the front door. Everything that needs the operator sits above it, behind an invitation.

| Layer | Who sees it | Made from | Gives |
|---|---|---|---|
| 1. Spectrum card | public | public evidence only | signature, stage, badges, constellation |
| 2. Claimed card | public, marked as claims | the company adds links and answers the Declared questions | higher levels where evidence supports them; the Claimed badge |
| 3. [GAMMA-Ray rating](../rating/index.md) | the company; published with consent | Declared and Evidenced tiers, operation facts observed | freedom, governance, the level held, a work order |
| 4. RiskMandate | the company only | the measured grant, the mandate, the barriers | the gap, and what would close it |

[RiskMandate](../lens/index.md) is not in the public layer: mandate, grant and delta need the operator. Five of the questions (the registry, accountability, policy, incidents, readiness) feed no public level; a company answers them when it claims its card.

## The rules

1. **Say what is there.** A card lists evidence found. Absence appears only as a next unlock.
2. **Not evidenced is not no.**
3. **A card needs something to show.** No card is published unless one dimension reaches level one. Anyone else gets an invitation.
4. **Published as beta, then the company is told.** A card is published once it has had two rounds of review and a sign-off. The company is told afterwards and invited to [correct or claim it](../feedback/index.md) and add evidence.
5. **No adjectives, no ranking by number.** Cohorts sort by name; a leader is named per dimension, never overall.
6. **Announced is shown, not scored.**
7. **Corrections are dated and propagate.**
8. **The same rules for us.** Our own agents get cards first, as participant entries.

Every earlier rule of GAMMA-Ray stays: levels are computed, links are signed, a scan only reads, and everything carries the beta mark.