LangChain in the enterprise: what governance has to add

Key takeaways

• LangChain and LangGraph are excellent at what they claim: building agents and orchestrating their execution. They are not, and do not claim to be, enterprise governance.
• The gap is specific: identity that survives the framework, policy enforcement before tool calls, approvals that capture context, evidence that survives refactors, and stops the agent cannot bypass.
• The integration pattern that works is wrapping, not forking: keep LangGraph for orchestration, put the governance layer around the runtime at the model and tool boundary.
• Teams that try to build governance inside the framework rebuild a control plane piecemeal and own it forever. The framework should stay a framework.

What the framework actually gives you

Credit where it is due, because the enterprise relationship with LangChain starts from respect: LangChain standardized the building blocks (model bindings, tool abstractions, retrievers, memory), and LangGraph made multi-step, stateful agent execution explicit and inspectable — a graph you can see, checkpoint, and resume is a genuine engineering advance. Callback handlers give observability a standard surface. For a team building an agent, these are the right tools.

The gaps only appear when the question shifts from “how do we build this?” to “how does the institution run this?” — and they are gaps by design, not by neglect:

Identity is not a framework concept. The agent runs under whoever’s credentials initialized it. Nothing in the framework distinguishes one deployed agent from another at the infrastructure level, so attribution stops at the application boundary.

Tool calls are application decisions. The framework will call any tool the graph wires up. Whether that call should happen — this agent, this scope, this moment — is a policy question the framework has no authority to answer.

Approvals are interrupt points, not approval workflows. LangGraph’s interrupts and checkpoints are exactly the right primitive — pause the graph, wait, resume. But an approval needs a named human, the evidence they saw, their recorded reason, and separation from the person who built the agent. That is a workflow system, not a checkpoint.

Evidence lives in application callbacks. Callbacks fire inside the application process; the records they produce are as mutable and as fragile as the application. Tamper-evidence, retention policy, and export-to-SIEM are infrastructure concerns the application layer cannot enforce on itself.

Stops are code decisions. A max-iterations setting is a courtesy the agent’s own runtime extends to itself. The stop that matters — revoke the identity, refuse every call — must work when the code does not cooperate.

The integration pattern: wrap, don’t fork

The pattern that keeps both sides’ strengths: LangGraph runs the graph; the governance layer owns the boundary.

• Identity in, grants attached. Each deployed agent registers in the control plane and receives its own identity. Its runtime initializes model and tool clients through the gateway, never direct.
• The gateway is the policy point. Every model call and tool invocation passes the gateway, which verifies identity, evaluates policy, enforces budgets, gates consequential actions, and writes the evidence record — before execution.
• LangGraph interrupts become gate callbacks. Where the graph declares a human-approval point, the gateway’s approval workflow fulfills it: the named reviewer, the evidence payload, the recorded decision. The graph’s checkpoint/resume machinery makes the pause natural; the control plane makes the approval real.
• Version pinning at deploy. The manifest records which agent build, model versions, prompt versions and tool grants constitute “this agent” — so what runs in production is what was approved, and the run record replays against pinned versions.
• The stop is upstream. Stopping means the gateway refuses everything for that identity. The graph’s own settings become a second layer, not the only one.

This is why Moring is framework-agnostic: the same gateway, registry, gates and evidence serve a LangGraph agent, a CrewAI crew, a Bedrock Agent, or a hand-rolled loop. The framework is the customer’s choice; the governance is the institution’s requirement.

When building it yourself makes sense — and when it doesn’t

Building governance inside your LangStack is defensible in exactly one case: governance-as-product is part of your business. Otherwise, cost the DIY honestly: identity propagation, a policy engine, an approval workflow with audit, tamper-evident storage with retention, drill-tested stops — each maintained across framework version churn, each with the failure modes discovered in production rather than in a vendor’s hardening history. The framework’s release pace, which is its strength for features, is a tax on anything you bolt into its runtime. Keep the framework for orchestration; buy the boundary.

Sources

• LangChain and LangGraph documentation, 2026 — architecture, interrupts, callbacks.
• The MCP governance page covers the tool-transport layer; the control plane glossary entry defines the boundary layer.

Frequently asked questions

About the author

Balaji Nagaraj KumarChief AI Officer, Moring AI, Moring AISweden

Leads platform and delivery engineering at Moring AI, turning each engagement into a substrate the customer’s own team operates at handoff. His background spans developer-platform leadership at Volvo Cars and engineering at CERN. He writes about governance for agents that take actions in production systems.

LinkedIn profile →