How to Add Governance to LangChain Agents

Correction, 11 October 2026: this post first gave the EU AI Act high-risk dates as they stood before the amendment. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk dates to 2 December 2027 for Annex III systems (originally 2 August 2026) and 2 August 2028 for Annex I systems (originally 2 August 2027). The text below uses the amended dates.

LangChain agents call tools autonomously: databases, APIs, CRMs, deployments. When an agent calls a tool, there is no built-in cryptographic proof of what happened. Callback logs are mutable text streams that prove nothing to an auditor.

Why this matters now

EU AI Act Article 12(1) says high-risk AI systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system". Article 12(2) says the logging capabilities must enable the recording of events relevant to risk situations or substantial modifications, to post-market monitoring and to the deployer's monitoring of the system. Article 12 does not prescribe a log format or a signature. Enforcement for high-risk systems begins 2 December 2027 (Annex III), with embedded products following on 2 August 2028, under the Digital Omnibus deferral enacted as Regulation (EU) 2026/1744 (in force 27 July 2026). A LangChain agent falls under Annex III only when it is used for one of the purposes listed there, such as screening job applicants, scoring creditworthiness or pricing life and health insurance. In that case its logging has to meet Article 12. Penalties reach 15 million EUR or 3% of turnover (Article 99(4)).

The integration

Step 1: Install

pip install asqav

Step 2: Add governance

from asqav.extras.langchain import AsqavCallbackHandler

handler = AsqavCallbackHandler(agent_name="my-langchain-agent")
agent.invoke(input, config={"callbacks": [handler]})
# Chain runs, tool calls and LLM calls that reach the handler go to Asqav for signing

Three lines of setup. The handler sends each tool call it sees to Asqav, which signs it with ML-DSA (NIST FIPS 204). If signing fails, including when a policy refuses it, a warning goes to the log and the call runs without a receipt. The handler has no fail-closed option in asqav 0.10.10.

What you get

• Agent identity: Each action tied to a cryptographic key pair.
• Timestamp: Anchored to Asqav's time source.
• Action details: Tool called, parameters, result.
• Cryptographic signature: ML-DSA proof the record has not been modified.
• Policy evaluation: Whether policies were checked and the outcome.

Records are tamper-evident rather than merely access-controlled. Any edit to a signed field invalidates the signature, any deletion breaks the per-agent hash chain at the next receipt, and the external timestamp anchor catches a backdate. An auditor re-derives each hash from the canonical bytes instead of trusting a stored column.

Policies

Policies run on the Asqav server against each action the handler sends, for example a time window for tool calls or a rate limit per agent. On the handler path a policy can raise an alert, but it does not stop the tool. When a policy refuses a signature, the handler logs the refusal and the tool runs with no receipt for that call. A call made outside LangChain's callback path is not checked or signed, so treat the handler as a framework callback and not as a sandbox.

The OWASP Top 10 for LLM Applications identifies insecure output handling and excessive agency as critical risks. If a tool must not run when a policy refuses it, put @asqav.sign on the tool's function. The decorator signs before the function body and skips the body when signing is refused (see Enforcement).

Agent revocation

If an agent is compromised, revoke its signing key immediately. The agent can still run but cannot produce valid signatures, so its governed actions are rejected. Revocation takes effect in seconds.

For a broader incident, the SDK also exposes an organization-wide emergency_halt() that halts every agent under the org in one call and records the halt reason into the audit trail. The narrow tool is key revocation on a single agent; the wide tool is the org-wide halt when you do not yet know which agent is the problem.

Getting started

Follow the integrations guide for the complete setup. Start with your highest-risk agent and expand from there.

References

• Regulation (EU) 2024/1689 (EU AI Act), EUR-Lex
• FIPS 204: Module-Lattice-Based Digital Signature Standard, NIST
• OWASP Top 10 for LLM Applications, OWASP GenAI Security Project