LangChain agents call tools autonomously: databases, APIs, CRMs, deployments. When an agent calls a tool, there is no built-in cryptographic proof of what happened. Callback logs are mutable text streams that prove nothing to an auditor.
Why this matters now
EU AI Act Article 12 requires automatic, structured, tamper-evident logging for high-risk AI systems. Enforcement for high-risk systems begins 2 December 2027 (Annex III), with embedded products following on 2 August 2028, under the Digital Omnibus deferral pending final EU adoption. If your LangChain agents operate in Annex III categories (finance, healthcare, employment, critical infrastructure), standard logging does not satisfy the requirement. Penalties reach 35 million EUR or 7% of turnover.
The integration
Step 1: Install
pip install asqavStep 2: Add governance
from asqav.extras.langchain import AsqavCallbackHandler
handler = AsqavCallbackHandler(agent_name="my-langchain-agent")
agent.invoke(input, config={"callbacks": [handler]})
# Every chain run, tool call, and LLM interaction is now signedThree lines of setup. Every tool call is now cryptographically signed with ML-DSA (NIST FIPS 204).
What you get
- Agent identity: Each action tied to a cryptographic key pair.
- Timestamp: Anchored to Asqav's time source.
- Action details: Tool called, parameters, result.
- Cryptographic signature: ML-DSA proof the record has not been modified.
- Policy evaluation: Whether policies were checked and the outcome.
Records are tamper-evident rather than merely access-controlled. Any edit to a signed field invalidates the signature, any deletion breaks the per-agent hash chain at the next receipt, and the external timestamp anchor catches a backdate. An auditor re-derives each hash from the canonical bytes instead of trusting a stored column.
Policy enforcement
Define policies that gate tool calls: block database writes outside business hours, require human approval for production data modifications, rate-limit API calls, restrict tools by agent role. The OWASP Top 10 for LLM Applications identifies insecure output handling and excessive agency as critical risks. Policy enforcement addresses both. Policies are enforced at the Asqav layer, so a compromised agent cannot bypass them.
Agent revocation
If an agent is compromised, revoke its signing key immediately. The agent can still run but cannot produce valid signatures, so its governed actions are rejected. Revocation takes effect in seconds.
For a broader incident, the SDK also exposes an organization-wide emergency_halt() that halts every agent under the org in one call and records the halt reason into the audit trail. The narrow tool is key revocation on a single agent; the wide tool is the org-wide halt when you do not yet know which agent is the problem.
Getting started
Follow the integrations guide for the complete setup. Start with your highest-risk agent and expand from there.