# AC059 rubric, fixed before scoring (16 October 2026, PKT)

Written before any platform was scored. Not changed after scoring began, except where noted in "Amendments" at the bottom.

## Unit of review
One named agent product per vendor, reviewed through the vendor's **own public documentation** (docs sites, help centres, trust/security pages, published policies). No sign-in, no trial accounts, no hands-on testing, no third-party write-ups, no sales material that is not documentation.

## Criteria
| # | Criterion | Documented | Partial | Not found |
|---|---|---|---|---|
| C1 | Permissions/scopes listed | Docs enumerate what the agent or its tools/connectors may access or do (named permissions, scopes, tool-level permission rules, or an explicit statement of whose credentials actions run under) | Access described only in general terms ("can access your email and files") | Neither located |
| C2 | Least-privilege guidance | Docs explicitly tell the customer to grant the minimum access needed (e.g. "least privilege", "enable only the apps needed") | Restriction is possible but docs give no recommendation to use it, or advice is generic security advice not tied to the agent's access | Neither located |
| C3 | Human approval for actions | Docs describe a mechanism by which a person must confirm an agent action before it runs (built-in or configurable) | Approval mentioned without explaining when or how it applies, or only as a pattern the customer must build entirely themselves with no documented primitive | Neither located |
| C4 | Action log / audit trail | Docs describe a record of the agent's individual actions or tool calls available to the customer or admin | Only conversation/session/admin-change logs, or action logs stated to be unavailable on part of the product | Neither located |
| C5 | Data retention | Docs state a retention period for agent data (conversations, transcripts, traces, screenshots, run history) or describe a customer-set retention control | Retention mentioned without a period or control | Neither located |
| C6 | Admin controls | Docs describe organisation-level controls to turn the agent on/off, or restrict which users, tools or connectors it can use | Controls exist only per user/agent with no organisation-level policy | Neither located |
| C7 | Revocation | Docs describe how to withdraw an agent's access: disconnect a connection, revoke a token/credential, or disable/delete the agent | Revocation only implied (e.g. "manage connections") without the step | Neither located |
| C8 | Third-party tool/connector risk | Docs warn that third-party tools, connectors, MCP servers, plugins or community nodes carry risk or are not vetted/controlled by the vendor | Third-party tools mentioned with only a generic caution | Neither located |
| C9 | Prompt-injection warning | Docs name prompt injection (or malicious instructions embedded in content the agent reads) as a risk for the agent | Only general "AI can make mistakes / may be manipulated" language | Neither located |
| C10 | Security disclosure route | Vendor publishes a vulnerability-reporting route (bug bounty, VDP, security.txt or documented security contact) that covers the product | Only a generic support/contact route | Neither located |

## Search procedure (same for every platform)
1. Start at the product's official documentation landing page and its security/permissions/admin pages.
2. Follow links within the vendor's own domains.
3. Use web search restricted to the vendor's domains with the criterion's key terms.
4. Review up to about 8 pages per platform. Record the single best URL behind each cell, with a short note.
5. "Not found" means not located by this procedure on 16 October 2026. **It does not mean the feature does not exist.**

## Scoring
Documented = 2, Partial = 1, Not found = 0, for coverage summaries only. The totals are a measure of documentation found, not of product security.

## Amendments and deviations (recorded after scoring)
- **Search step applied selectively.** Step 3 (vendor-domain web search) was run for every cell still at Not found after steps 1–2 (four cells: LangChain C9, Glean C8, n8n C7, Zapier C8; all four were then located) and for Gemini Enterprise C2. Partial cells did not all get a search, so some Partials may be understated. Criteria and score definitions were not changed.
- **Product scope.** OpenAI's ChatGPT agent help page stated the product "is no longer available" on 16 Oct 2026; the current successor, ChatGPT Work (with cloud browser and connected apps), was scored. The retired page is cited as context only.
- **Fetch routes.** Salesforce Help articles did not render for automated fetching; Salesforce was scored from architect.salesforce.com and its disclosure policy. ServiceNow docs were read from the official ServiceNow/ServiceNowDocs GitHub mirror (branch australia), citing canonical servicenow.com URLs.
- **Judgment rules applied consistently:** a statement shifting responsibility to the customer without describing risk = Partial for C8; an agent's explicit tool/action list = tool-level permission (Documented) for C1; instruction-based approval plus a documented deterministic step = Documented for C3.