LangGraph

Secure LangGraph tool calls before graph compilation while preserving graph state and runtime behavior.

1. Install

pip install 'quasentra[langgraph]'

2. Create local tools

Keep each business capability as a named, typed tool. Underscores in tool names become dots in policy actions.

from langchain.tools import tool

@tool
def customer_read(customer_id: str) -> str:
    """Read a customer record by ID."""
    return company_database[customer_id]

@tool
def customer_delete(customer_id: str) -> str:
    """Permanently delete a customer record."""
    del company_database[customer_id]
    return "deleted"

3. Secure the agent

import os
from langchain.agents import create_agent
from langchain.chat_models import init_chat_model
from quasentra import Quasentra

security = Quasentra(api_key=os.environ["QUASENTRA_API_KEY"], base_url=os.environ["QUASENTRA_URL"])
tools = [customer_read, customer_delete]
middleware = security.langgraph(
    agent_id="support-agent", name="Support Agent", tools=tools,
    permissions={"customer.read": "ALLOW", "customer.delete": "DENY"},
)
agent = create_agent(model=init_chat_model(os.environ["AGENT_MODEL"]), tools=tools, middleware=[middleware])
result = agent.invoke(
    {"messages": [{"role": "user", "content": "Read customer CUST-100"}]},
    config={"configurable": {"thread_id": "support-1001"}},
)
security.close()

4. Confirm enforcement

1. Start the application once.
2. Open Dashboard → Agents and confirm the agent and tools were discovered.
3. Open Policies and confirm every action has the intended effect.
4. Request an allowed action and confirm the implementation runs.
5. Request a denied action and confirm it appears in Decisions but never reaches the implementation.

Runtime guarantees

• Agent and tool metadata sync idempotently at construction/startup.
• Newly discovered tools receive default-DENY.
• A denied or approval-required tool implementation does not execute.
• Authorization transport exhaustion fails closed.

Security boundary

Middleware must be present before the graph is compiled. Do not retain an unwrapped tool path for sensitive operations.

Do not keep another unwrapped path to sensitive functions. For high-impact tools, move credentials and execution into the trusted gateway.