Admina Score vs OISG Adequacy
Admina's dashboard surfaces two 0–100 governance scores. They look similar at a glance but answer fundamentally different questions — live runtime vs static capability — and you should read them together, not in isolation.
The one-line difference
Side-by-side reference
admina.yaml and which plugins are wired up GET /api/dashboard/score GET /api/dashboard/oisg How to read them together
The two scores are independent axes. Any combination is possible and each combination tells you something different about where to focus.
The instance is designed correctly AND the live traffic is being governed by all wired-up defences. This is the target state for any Admina deployment.
Next step: Nothing to fix. Monitor for regressions; expand coverage to new domains (multi-tenancy, compliance templates) as adoption grows.
The capabilities are wired up but the live runtime signals are weak. Typically: the proxy is up but no traffic is flowing through it yet, or the forensic chain is still at GENESIS.
Next step: Route real agent traffic through the proxy, seed the forensic chain, run an EU AI Act classification — the Admina Score will climb as the runtime fills in.
Real traffic is flowing and nothing bad is happening right now, but several OISG capabilities are not configured — the instance is missing defences it would benefit from.
Next step: Walk through the OISG criteria that are failing (e.g. cryptographic agent identities, bidirectional injection defence, explainability endpoint) and enable the corresponding admina.yaml sections.
Neither the configuration nor the live runtime is reaching adequate governance levels. This is expected during a fresh install before <code>admina init</code> / <code>admina dev</code> have been run end-to-end.
Next step: Finish the quickstart, bootstrap secrets, enable all four governance domains in admina.yaml, and route at least one governed request through the proxy.
When to look at which score
You are investigating a production incident or suspicious activity. Start with the Admina Score — it reflects whether governance was actually engaged at the time of the event. Drill into the live feed and forensic log from there.
You are assessing whether an Admina instance is fit for purpose before ramping traffic through it. Start with the OISG Adequacy — it tells you which defences are in place without requiring traffic.
Auditors want both. OISG shows the instance is designed to a recognised public framework; the Admina Score — together with the forensic black box — shows governance actually executed on every real interaction.
You are about to expose Admina to a new workload or tenant. Check OISG first (does the current configuration cover the new threat surface?), then watch the Admina Score as you ramp traffic to confirm the runtime keeps up.