OpenClaw Was Perfect Until a Second Person Needed to Log In

A working engineer’s take on when a personal AI assistant stops being enough, and what to reach for next.

It is 7:40 on a Tuesday, and my assistant has already read my email.

Not all of it. The junk is gone, the newsletters are stacked in a pile I will never open, and three messages sit at the top with a one-line note on each. One needs a reply before lunch. One is a calendar invite that collides with my kid’s dentist appointment. One is from my landlord and can wait a week. I did not ask for any of this. It just happened, quietly, on a small server humming under my desk.

That assistant is OpenClaw. I have run it for months, and I am fond of it, the way you get fond of a tool that respects you.

Then I made the mistake of showing it to my team.

What OpenClaw gets right

Let me be clear about something before I say anything critical. OpenClaw is good. Genuinely good.

It runs on your own hardware. The Gateway, its central daemon, sits on port 18789 and owns your connection to the outside world. It talks to you on the channels you already use. WhatsApp through Baileys, Telegram through grammY, Slack, Discord, Signal, iMessage, and a couple dozen more once you install the plugins. There are well over a hundred of those plugins, covering channels, model providers, search tools, and memory backends. If you want your assistant to run on a local model through Ollama or vLLM so that not a single token leaves the building, you can do that today.

It is MIT licensed. You can read every line. When something behaves strangely at midnight, you can open the TypeScript and find out why, which is more than I can say for most software I pay for. There is a registry called ClawHub for community skills, native mobile apps that pair to your Gateway as nodes, and a live Canvas the agent can draw on. For one person who likes to tinker, this is close to the dream. Your data, your models, your rules.

I want to sit in that praise for a second, because what comes next is not a takedown.

The wall

Here is what happened. A teammate watched Molty (that is the assistant persona OpenClaw ships, a small space lobster with opinions) sort my morning and asked the obvious question. “Can I have that for the support inbox?”

So I tried to set it up for three of us. And I ran straight into a wall that OpenClaw, to its credit, tells you about in plain language.

Open the project’s SECURITY.md and you find it stated plainly. In its own words, OpenClaw "does not model one gateway as a multi-tenant, adversarial user boundary." The recommended model is one user per machine. There is no per-user authorization split between the people calling the Gateway. If three of us share one host, we share everything on it. The auth is a shared secret. The sandbox that would isolate untrusted tool calls is off by default for your main session, because when it is only you, tools running directly on the host is a feature and not a risk.

None of that is a bug. Read it again. It is a design decision, stated out loud. OpenClaw knows exactly what it is. A personal assistant, built for a person, refusing to pretend otherwise. I respect that more than the products that promise everything and quietly mix your data between tenants.

The problem was not OpenClaw. The problem was that I had outgrown the thing it was built to be.

Enter Sophon

While looking for something that could cross that line, I found Sophon. And the first thing I noticed was how familiar it felt.

The vocabulary is familiar. Gateway, agents, skills, nodes, canvas, memory, sandbox. It reaches the same messaging platforms most teams already live in, through its own .NET adapters such as the WhatsApp Business Cloud API and a native Telegram adapter. If you have used OpenClaw, you can read Sophon’s docs without a dictionary. One is named after a space lobster. The other after the proton-sized supercomputer from The Three-Body Problem. You can already feel the difference in ambition.

Under the hood, they part ways fast. Where OpenClaw is TypeScript on Node, Sophon is .NET 10, shipped as a modular monolith. One binary that runs as a single-user app on SQLite for personal use and scales to a multi-tenant deployment from the same codebase, with the difference being configuration rather than a different product. Personal, Pro, and Enterprise are three settings of one engine.

The familiarity is nice. What matters is what it adds the moment a second person logs in.

What changes when you cross the line

Here is the honest side-by-side. Not marketing. Just where the two diverge once you stop being a team of one.

Let me pull three of those rows out, because they are the ones that actually kept me up at night.

Identity and access. OpenClaw hands the Gateway a shared secret. That is fine for you. It is not fine for a support team where people join, leave, and change roles every quarter. Sophon does role-based access control with OIDC single sign-on behind it, so the assistant plugs into the same identity system as the rest of your company, and access dies when someone’s account does.

Secrets. This is the one I care most about. In Sophon, credentials live in a vault and are brokered, which means the language model never sees the raw token. The agent asks to send an email, the tool sends it, but the key that authorizes the send never enters the prompt. If you have ever felt the small cold dread of an API key sitting in a context window, you know why this matters.

Audit. When your security team asks who did what and when, “check the logs on the box under Dave’s desk” is not an answer. Sophon logs every action, who ran it, when, what it touched, and how it turned out. That is the difference between a tool you use and a tool you can defend in a review.

There is a fourth thing I did not expect to like. Approval gates. Every action gets a risk score, from none up to critical, and the risky ones stop and wait for a human. The first time it earned its keep was at 2 in the morning, when an on-call routine tried to run a shell command that would have bounced the wrong service. Sophon paused, posted the exact command to the on-call channel, and waited. Someone tired but awake typed no. On my main OpenClaw session, that command would have simply run. For me alone, fine. For a team touching production, that pause is the whole point.

And then there is memory, which changes character once a team is involved. OpenClaw remembers plenty on its own. It keeps a curated MEMORY.md, writes dated daily logs, and consolidates them over time. But it loads that long-term memory only in your private session, not in shared or group contexts, because it is built for one person. On Sophon, memory is shared by design. When our support team answers the same customer across WhatsApp, email, and Slack, all three land in one shared memory, so the second agent to touch the ticket sees the whole story instead of a fragment. The first time a colleague picked up a thread I had dropped and just knew the context, without me forwarding a thing, was the moment the team stopped treating it as my toy and started treating it as ours.

The honest tradeoffs

Now the part most articles skip.

Sophon is commercial. It is not MIT. If open source is a hard line for you, that line just got drawn, and Sophon is on the wrong side of it.

It is also heavier. At the top tier it wants PostgreSQL, a Qdrant vector database, and RabbitMQ for messaging. That is real infrastructure with real operational cost, and it is overkill for a party of one. OpenClaw is happy on a modest machine under your desk. Sophon at full stretch wants a cluster.

And it is younger as a product than the platforms your CIO already trusts, though so is OpenClaw. Neither of these has a decade of scars yet.

So if you are a solo operator who loves reading the source at midnight and running everything on a local model, do not switch. You already have the right tool. OpenClaw is not the thing you settle for. It is the thing that fits.

Who should switch, who should not

Stay on OpenClaw if you are one person, or a couple of people who trust each other completely, you care more about hackability than governance, and MIT is non-negotiable.

Move to Sophon if you are a team or an organization, someone in security is going to ask about audit and access, you need people to sign in with their real corporate identity, and you want the assistant’s risky actions to pause for a human before they land.

The question is not “which is better.” The question is “how many people need to log in, and who is accountable when it acts.”

The space lobster and the proton

I did the obvious thing in the end. I kept OpenClaw on the server under my desk, where it still reads my email at 7:40 every morning and answers to no one but me. And I stood up Sophon for the team, where it answers to all of us and keeps the receipts.

One built for a person. One built for a company. I am glad I did not have to give up the first to get the second.