What I wish someone had told me about securing LangGraph agents before I started building them.
Understanding LangGraph's architecture before you try to secure it.
Every channel through which adversarial content can reach a LangGraph agent — thirteen attack surfaces, mapped.
Seven threat categories attackers use against LangGraph agents — how they work mechanically, and what to look for.
Adapting STRIDE for LangGraph agents — where standard threat modeling breaks down, and how to produce a model that ships controls instead of artifacts.
Input validation for LangGraph agents — why the classical framing breaks down on natural language, and what actually works across user, retrieval, and state channels.
Tool security for LangGraph agents — least privilege, parameterized interfaces, SSRF and path-traversal protection, sandboxing, output validation, and the anti-patterns to actively avoid.
State and memory security for LangGraph agents — trust-tiered schemas, immutable trusted context, encrypted checkpoints with integrity verification, namespaced long-term memory, and cross-session isolation.
Multi-agent security for LangGraph systems — why you can't trust your own agents, trust tiers and the downgrade rule, HMAC-authenticated messages, scoped delegation, quarantine layers, and patterns that contain compromised sub-agents.
Output guardrails for LangGraph agents — the last layer between the agent and the world, covering pattern-based sensitive data detection, exfiltration screening, structured output enforcement, tool call argument inspection, and shadow-mode tuning that keeps false positives in check.
Authentication and authorization for LangGraph agents — why agents complicate the well-trodden ground of OAuth, JWTs, and RBAC, covering infrastructure-established identity, action-time authorization enforcement, signed system prompts, credential injection that keeps secrets out of the context window, and OAuth for user-delegated access.
Security observability for LangGraph agents — why prevention is never enough and detection has to capture what agents decide and why, covering a four-layer stack of structured logging, metrics aggregation, anomaly detection and alerting, behavioral baselines, and SIEM and LangSmith integration.
Human-in-the-loop as a first-class security control for LangGraph agents — why human judgment defends against novel, irreversible, and high-blast-radius actions that automation structurally cannot, covering interrupt placement, the LangGraph interrupt() pattern, sanitized review packages, approval validation against spoofing, securing the review interface, and fail-safe degradation.
Rate limiting for LangGraph agents requires five independent control levels beyond conventional gateway limiting — covering request rates, session execution bounds, loop detection, token budgets, and cost circuit breakers — because agents amplify a single user request into unbounded resource consumption in ways that web application rate limiting structurally cannot see.
Individual security controls applied to an insecure architecture produce whack-a-mole defense. Seven architectural patterns — perimeter nodes, privilege separation, immutable audit trails, minimal context windows, isolated subgraphs, dead man's switches, and canary nodes — compose into a structure where a compromise at any single point has a bounded blast radius.
Security controls that haven't been tested are security controls that may not work. A layered testing pyramid — static analysis, adversarial unit tests, integration security tests, and red teaming — plus probabilistic testing for LLM-based controls and CI/CD integration that keeps live-model tests off the PR critical path.
Every LangGraph agent runs on a stack of dependencies it did not write and cannot fully audit. SBOMs, OSV vulnerability scanning, hash-pinned lockfiles, runtime integrity verification, typosquatting detection, and model provenance — the controls that make an invisible attack surface visible.