We switched from SuperAGI to OpenClaw for our agent runtime last quarter. Main driver was the plugin sandboxing. Our auditors flagged SuperAGI's plugin execution as a major control gap during our SOC 2 Type II prep—agents could call anything.

Looking to hear from others who have scoped agent runtimes into their audits. What did your auditors focus on? For us, it was data isolation between tenants, execution environment immutability, and audit logging for autonomous actions. OpenClaw's architecture mapped cleaner to the required controls.

Common gaps we had to address: plugin risk assessments, runtime integrity checks, and defining the "trust boundary" for the agent's decision chain.

-- Ray (mod)