OpenBox AI vs Prefactor (2026)

SDKs and plugins wrap agents built on Temporal (a Python plugin), LangChain, LangGraph, CrewAI and Deep Agents in Python, and Mastra and CopilotKit Runtime v2 in TypeScript. An n8n community node and an OpenRouter SDK round out the set. Each operation the agent takes passes through OpenBox for a verdict. These integrations govern actions the customer's own framework takes. Agents cannot take authenticated action in an outside system through OpenBox. Cursor and OpenClaw integrations are coming soon.

SourceOpenBox, docs.openbox.ai/getting-started and /developer-guideread 2026-09-25

Agents built on LangChain, CrewAI, Anthropic, OpenAI and other stacks are instrumented through Prefactor's SDKs, framework middleware and OpenTelemetry support, so their steps flow in as spans. These bring telemetry in. Prefactor names no connector that lets an agent take authenticated action in an outside system through it.

SourcePrefactor, docs.prefactor.ai llms-full.txt (SDK overview, instrumentation strategy) and prefactor.tech llms-full.txtread 2026-09-25

The customer's framework, such as Temporal, LangGraph or CrewAI, owns the workflow, its steps and its handoffs, and OpenBox governs those runs without running them. A HALT verdict cancels the framework's workflow. Multi-Agent Sessions is a view of each team's runs. OpenBox names no workflow model of its own.

SourceOpenBox, docs.openbox.ai/core-concepts/governance-decisions and /administration/organization/teams/multi-agent-sessionsread 2026-09-25

Steps, sequencing and handoffs belong to the agent's own framework. Prefactor records and scores what agents do and does not run their work, and it never ends a run on its own schedule. Agent versions and deployments across environments track releases, and Prefactor has no workflow model of its own.

SourcePrefactor, docs.prefactor.ai llms-full.txt (Instance, Deployments and Versions tabs)read 2026-09-25

The customer's own runtime, such as Temporal, LangChain or n8n, starts and runs the agent. OpenBox's SDKs wrap that agent, and every governance evaluation responds to an operation the agent began. Alerts on trust tier changes and goal drift flag agents for people to review, and they do not wake an agent.

SourceOpenBox, docs.openbox.ai/getting-started and /dashboard/alerts; docs.openbox.ai/dashboard/alertsread 2026-09-25

Runs start in the customer's own code. The agent's integration registers each run when it starts, and the WebSocket stream sends updates about runs outward. Prefactor does not start agents, and it has no schedule, webhook or event of its own that wakes one.

SourcePrefactor, docs.prefactor.ai llms-full.txt (Instance, Stream agent instance updates)read 2026-09-25

OpenBox is a governance layer around the customer's agent, and it names no way to index or retrieve the customer's documents for the agent to ground its answers on. Guardrails inspect the agent's inputs and outputs.

SourceOpenBox, docs.openbox.ai/overview and the docs index (llms.txt and llms-full.txt)read 2026-09-25

Grounding sits outside the product. Prefactor records and scores agent runs, and it indexes none of the customer's documents for an agent to ground its answers on. There is no retrieval structure over the customer's corpus.

SourcePrefactor, docs.prefactor.ai llms-full.txtread 2026-09-25

Trust score history, approval history and behavioral rules that track patterns over several steps all describe the agent. OpenBox applies them as governance rules, and the agent never reads them as context for its decisions. The Enterprise plan includes Universal Agent Memory Governance, which governs the customer's memory instead of providing one, and OpenBox describes it no further. OpenBox names no memory layer or state the agent reads across runs.

SourceOpenBox, docs.openbox.ai/core-concepts/trust-scores, /trust-lifecycle/authorize/behaviors and openbox.ai/pricingread 2026-09-25

Run records, risk scores and quality results are kept about agents, and the agent never reads them as context to decide. Prefactor describes no memory layer.

SourcePrefactor, docs.prefactor.ai llms-full.txtread 2026-09-25

When an operation crosses a risk threshold, a policy calls for review or the agent's trust tier requires it, OpenBox returns REQUIRE_APPROVAL. The operation pauses and appears in the Approvals queue, where a reviewer approves, rejects or escalates it. An unanswered request expires. Who approved or denied, and when, is recorded with the decision.

The Adapt tab shows each agent's pending approvals with risk tier, semantic action type and triggering rule, plus approval history and approval rate. Chained guardrails screen the inputs and outputs of every operation, and BLOCK and HALT verdicts stop an action or end the session. Each framework SDK has its own way of enforcing these verdicts.

SourceOpenBox, docs.openbox.ai/core-concepts/governance-decisions, /trust-lifecycle/adapt, /trust-lifecycle/authorize/guardrails and /administration/compliance-and-auditread 2026-09-25

The oversight control is manual. While a run is active, an operator can terminate it from the agent instance page with a stated reason, and the agent's integration winds the run down. Risk profiles classify each run from the capabilities its spans declare. Crossing a threshold does not automatically block or terminate a run, because the classification is a label for human review and enforcement remains with the customer's team. Prefactor's pricing advertises real time hold, approve or block, which its docs contradict. Prefactor describes no approval step or guardrail beside the stop control.

SourcePrefactor, docs.prefactor.ai llms-full.txt (Agent instance page, Risk tab, Risk profile) and prefactor.tech/pricingread 2026-09-25

Admin, Developer and Viewer roles are set under Organization > Permissions. A Viewer can see agents, logs and reports but cannot change anything. Teams decide which agents a member can see and which sessions they can act on. Each agent also carries its own cryptographic identity, a DID and an Ed25519 signing key kept separate from its API key. OPA/Rego policies run stateless permission checks on every agent operation, giving least privilege tool access. An organization audit log records who changed what. OpenBox names no identity provider integration such as SSO, SAML or SCIM.

OpenBox shows ISO 27001, ISO 42001 and NIST badges on its site, but none links to a certificate, auditor, report or date. It names SOC 2, ISO 27001 and GDPR only as frameworks it maps its customers' audit evidence to.

SourceOpenBox, docs.openbox.ai/administration/organization, /administration/organization/teams, /core-concepts/agent-identity and /trust-lifecycle/authorize/policies, plus the openbox.ai footer and /solution/complianceread 2026-09-25

Accounts can sign in through single sign on with the customer's identity provider, which comes with the Enterprise plan. API tokens are created per account and revoked when their creator is removed. All members of an account share the same level of access, with no role based permission distinctions. Prefactor publishes no attestation of its own. Its records can serve as evidence in a customer's own SOC 2, ISO 27001 or EU AI Act review.

SourcePrefactor, docs.prefactor.ai llms-full.txt (Team tab, API tokens tab) and prefactor.tech/pricing and llms-full.txtread 2026-09-25

Session Replay steps through an agent session event by event, showing every tool call, governance decision and full JSON payload. The Monitor tab tracks each agent's invocations, response time and token use, along with cost and errors, over selectable time ranges.

Every governance decision goes into an immutable audit trail with verdict, reason, workflow and run IDs and approval metadata, and the trail exports on demand. Each session's events are hashed into a Merkle tree and signed into a tamper evident proof certificate, through AWS KMS by default or the customer's own attestation service. An organization audit log records user and configuration changes, separate from the runtime traces.

SourceOpenBox, docs.openbox.ai/trust-lifecycle/session-replay, /trust-lifecycle/monitor, /administration/compliance-and-audit and /administration/attestation-and-cryptographic-proofread 2026-09-25

Each agent run is recorded as an instance with its full span timeline of LLM calls, tool calls, message turns and custom business steps. The record ties the run to the agent version and activity schema version that produced it and, where a profile is assigned, to the run's risk classification. Prefactor calls this chain the audit trail. The Activity tab and a WebSocket stream show runs and updates live. Sensitive fields can be encoded before they leave the agent. Data retention runs from 7 days on the free plan to 12 months on the upper plans.

SourcePrefactor, docs.prefactor.ai llms-full.txt (The audit trail, Agent instance page, Activity tab, WebSocket API, Sensitive encoding) and prefactor.tech/pricingread 2026-09-25

The Enterprise plan includes Custom Deployment and SLAs, with no named environment, region or way to choose one. Every SDK guide points the agent at the hosted endpoint core.openbox.ai. OpenBox publishes no region list and names no self hosted or customer cloud option.

External attestation lets the customer sign proof certificates with its own attestation service or a Trusted Execution Environment. That choice sets where the signing key sits, not where OpenBox runs. OpenRouter routing policies can restrict model providers by data residency, which applies to the customer's model traffic, not to where OpenBox itself is deployed.

SourceOpenBox, openbox.ai/pricing, docs.openbox.ai/getting-started/deep-agents and /administration/attestation-and-cryptographic-proofread 2026-09-25

The service runs as managed cloud, and the Enterprise plan includes self hosted deployment. Prefactor describes no install steps, region or customer environment option. Dev, staging and production environments are logical environments inside the service.

SourcePrefactor, prefactor.tech/pricing and llms-full.txt, and docs.prefactor.ai llms-full.txt (Environments tab)read 2026-09-25

Four guardrail types, covering PII detection, content filtering, toxicity and banned words, can be chained into a pipeline for each agent. Three preconfigured risk profiles (low, medium and high) set an agent's starting trust tier. These are modules of one governance engine that the customer assembles, plus presets for settings. OpenBox names no catalog of ready made agents, workflows or policies.

SourceOpenBox, docs.openbox.ai/trust-lifecycle/authorize/guardrails and /trust-lifecycle/assessread 2026-09-25

Risk profiles can start from a preset that fills in weights. Prefactor ships no ready made agents, workflows or templates for a customer to adopt.

SourcePrefactor, docs.prefactor.ai llms-full.txt (Risk page)read 2026-09-25

The agent's framework chooses its model, and OpenBox evaluates the operations that result. OpenBox offers no model choice of its own for the customer's agent. The OpenRouter SDK's routing policies are Rego rules that allow or deny model providers and record proof of where each call was routed. They govern the customer's model traffic and offer no choice inside OpenBox. The Alignment Score uses an LLM evaluation that OpenBox calls configurable, and it names no provider list or way to select one.

SourceOpenBox, docs.openbox.ai/developer-guide/openrouter/routing-policies and /core-concepts/trust-scoresread 2026-09-25

Model choice stays with the agent's own framework. Prefactor records the model calls an agent makes but does not choose or route models. Its pricing includes optional bring your own LLM evals, but evaluation happens outside Prefactor, and Prefactor names no provider selection or customer model choice inside the product.

SourcePrefactor, docs.prefactor.ai llms-full.txt and prefactor.tech/pricingread 2026-09-25

SDKs for the platform include a Python Temporal plugin with a full API reference, Python SDKs for LangChain and LangGraph, CrewAI and Deep Agents, and TypeScript SDKs for Mastra and CopilotKit, plus an n8n community node and an OpenRouter SDK. Each comes with configuration options, error codes and an event model.

They authenticate to the hosted endpoint core.openbox.ai with API keys for each agent (live and test) and send each agent operation for a governance verdict. OpenBox names no REST API reference and no MCP server of its own. The MCP mentions in its docs belong to the Temporal demo agent.

SourceOpenBox, docs.openbox.ai/developer-guide/temporal-python/sdk-reference, /developer-guide/langchain and /getting-started/copilotkit/add-openbox-to-copilotkitread 2026-09-25

An HTTP API and a WebSocket API cover the platform (with rate limits, sensitive field encoding and live instance streaming), alongside a CLI for environments and agents, agent skills, and Python and TypeScript SDKs with configuration, schema, rate limit and termination handling.

SourcePrefactor, docs.prefactor.ai llms-full.txt (HTTP API, WebSocket API, Prefactor CLI, SDK overview, Python SDK)read 2026-09-25

The Verify phase scores each session's actions against the agent's declared goal with an LLM evaluation that OpenBox calls configurable. Results show as an Alignment Score from 0 to 100 percent, with check counts, a trend line against a threshold (70 percent by default) and logged drift events.

The score tracks the customer's agent's behavior over time, and it runs only on live sessions. OpenBox names no way to test an agent against fixtures, mocks or datasets before production, and no red teaming before deployment or CI/CD checks. The Adapt phase tunes governance rules, not the agent, and the Assess phase is a risk questionnaire.

SourceOpenBox, docs.openbox.ai/trust-lifecycle/verify, /core-concepts/trust-scores and /trust-lifecycle/assessread 2026-09-25

An agent's activity schema declares named quality schemas, and runs are marked as live, eval or smoke test. The customer's evaluation process submits its result after a run. The result shows on the run's Quality tab, with an optional summary template, and is recorded as quality spans. Prefactor does not produce these evaluations. The eval suite, grading model or human review happens outside it. The agent's own Quality tab shows run health over the last day, with success rate, typical and worst duration, and failures.

SourcePrefactor, docs.prefactor.ai llms-full.txt (Agent instance Quality tab, Agent Quality tab, Instance, Quality and performance) and prefactor.tech/pricingread 2026-09-25

Agent operations are governed, but OpenBox itself operates no browser or computer. Browsers appear only as steps in two demo walkthroughs.

SourceOpenBox, docs.openbox.ai/overview and the docs index (llms.txt and llms-full.txt)read 2026-09-25

Prefactor records and scores agent runs and does not operate a browser or a computer.

SourcePrefactor, docs.prefactor.ai llms-full.txtread 2026-09-25