Building AI Agents with LangChain: Production Security Patterns
Why LangChain for Production AI Agents?
LangChain has become the de facto framework for building AI agents that go beyond simple chat interfaces. It provides the primitives — chains, tools, memory, retrievers — that let you compose autonomous systems capable of reasoning, accessing external data, and taking real-world actions.
But the same flexibility that makes LangChain powerful also creates security challenges. A misconfigured chain can leak data, an unsandboxed tool can execute arbitrary code, and an unvalidated output can compromise downstream systems. Building production-ready agents requires security patterns that most tutorials skip entirely.
This guide covers the patterns we use at Masarrati when building LangChain agents for enterprise clients across healthcare, fintech, and cybersecurity.
Secure Chain Architecture
Chain Composition Best Practices
The way you compose chains determines your security posture from the start:
Separate reasoning from execution: Never let a single chain both decide what to do AND do it. Use a reasoning chain to plan actions, then pass validated action plans to isolated execution chains. This creates a natural checkpoint where you can inspect and approve actions before they happen.
Typed inputs and outputs: Define strict Pydantic models for every chain's input and output. This catches injection attempts that try to sneak extra fields or unexpected data types into the chain pipeline.
Chain-level rate limiting: Wrap each chain in a rate limiter that caps how many times it can execute per minute. An agent caught in a reasoning loop won't burn through your entire API budget before you notice.
Prompt Template Security
Your prompt templates are the first line of defense:
Parameterized templates only: Never build prompts through string concatenation. Always use LangChain's PromptTemplate with explicit input variables. This prevents injection through template manipulation.
System message isolation: Place security-critical instructions in the system message, not in the human message template. Most LLMs give higher priority to system messages, making it harder for injected content to override safety rules.
Input sanitization functions: Create preprocessing functions that strip known injection patterns before content reaches the prompt template — things like "ignore previous instructions," role-play commands, or encoded payloads.
Secure Tool Implementation
The Tool Security Framework
Every LangChain tool your agent can access is a potential attack vector. Here's how to lock them down:
Permission scoping: Each tool should declare its permission requirements upfront. A "read_database" tool should never have write permissions, even if the underlying database connection technically allows it.
Input validation: Tools must validate every parameter against strict schemas before execution. A search tool should reject SQL injection attempts in the query parameter. A file reader should validate paths against an allowlist.
Output sanitization: Tool outputs go back into the agent's context. Sanitize them to remove any content that looks like prompt injection — instructions, role assignments, or commands embedded in the data.
Timeout enforcement: Every tool call must have a hard timeout. An agent that calls an API endpoint controlled by an attacker could hang indefinitely without one.
Sandboxed Code Execution
If your agent needs to execute code (Python, SQL, shell commands), sandboxing is non-negotiable:
Container isolation: Run code execution tools inside ephemeral Docker containers with no network access, restricted filesystem mounts, and resource limits (CPU, memory, execution time).
Language restrictions: If the agent generates Python code, use AST parsing to block dangerous imports (os, subprocess, socket, requests) before execution. Maintain an allowlist of safe modules.
Output capture: Capture stdout/stderr from code execution and scan for sensitive data patterns (API keys, credentials, PII) before returning results to the agent context.
Memory Security Patterns
Securing Conversation Memory
LangChain's memory modules store conversation history that persists across interactions. This creates security concerns:
Encrypted storage: Use ConversationBufferMemory or ConversationSummaryMemory with an encrypted backend. Never store raw conversation history in plaintext files or unencrypted databases.
Memory isolation: In multi-tenant systems, each user's conversation memory must be completely isolated. Use separate encryption keys per tenant. A bug or injection in one user's session should never expose another user's data.
Memory expiration: Implement automatic expiration for sensitive data in memory. Financial details, health information, and credentials should be purged after the conversation ends or after a configurable TTL.
Injection-resistant summarization: When using ConversationSummaryMemory, the summarization step itself can be a vector for memory poisoning. Validate summaries against the original content to detect injected instructions.
Vector Store Security
If your agent uses RAG (Retrieval-Augmented Generation) with vector stores:
Document-level access control: Not every user should see every document. Implement metadata-based filtering that enforces access control at query time, before results reach the agent.
Embedding isolation: In multi-tenant setups, use separate vector store collections or namespaces per tenant. Shared embeddings across tenants create cross-contamination risks.
Retrieval validation: After retrieving documents, validate that they match the expected format and don't contain injection payloads before injecting them into the agent's context.
Output Validation and Guardrails
Multi-Layer Output Filtering
Never trust an agent's raw output. Implement validation at multiple levels:
Schema validation: If the agent is supposed to return structured data (JSON, function calls), validate against a strict schema. Reject any output that doesn't conform.
Content policy enforcement: Run agent outputs through a content classifier that checks for policy violations — toxicity, PII leakage, off-topic responses, or attempts to execute unauthorized actions.
Action verification: Before any agent action reaches an external system (API call, database write, email send), verify it against a policy engine that checks permissions, rate limits, and business rules.
Guardrail Chains
Build dedicated guardrail chains that run in parallel with your main agent:
Input guardrails: A classifier chain that evaluates user input for injection attempts, off-topic requests, or policy violations before the main agent processes it.
Output guardrails: A validator chain that reviews the agent's proposed response and actions before they're executed or returned to the user.
Escalation logic: When guardrails detect a violation, they should either block the action and return a safe default response, or escalate to a human reviewer for high-ambiguity cases.
Production Deployment Patterns
Observability and Monitoring
You can't secure what you can't see:
LangSmith integration: Use LangSmith or similar tracing tools to capture every chain execution, tool call, and LLM interaction. This gives you full visibility into agent behavior and a forensic trail for incident investigation.
Custom metrics: Track agent-specific metrics — tool call frequency, error rates, average chain length, token usage per interaction, guardrail trigger rates. Set alerts for anomalous patterns.
Real-time dashboards: Build dashboards that show agent health at a glance — active sessions, error rates, cost burn rate, guardrail violations. Your ops team should know immediately when something goes wrong.
Graceful Degradation
Production agents must fail safely:
Fallback chains: When the primary agent chain fails (LLM timeout, tool error, guardrail violation), fall back to a simpler chain that can handle the user's request with reduced capability rather than failing completely.
Circuit breakers: Implement circuit breakers on external tool calls. If a tool fails repeatedly, stop calling it and switch to an alternative approach rather than hammering a broken dependency.
Cost controls: Set hard limits on per-session and per-user LLM token usage. An agent stuck in a loop shouldn't be able to generate a $10,000 API bill before someone notices.
Infrastructure Security
API key management: Never embed API keys in code or configuration files. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault) and inject keys at runtime.
Network policies: Agent containers should have strict network policies — allowlisted outbound connections only. An agent should never be able to reach arbitrary internet endpoints.
Model access control: Use API-level access controls to ensure agents can only access the models they need. A customer support agent doesn't need access to your fine-tuned financial analysis model.
LangChain Security Checklist
Before deploying any LangChain agent to production:
- Chain composition separates reasoning from execution - All prompt templates use parameterized inputs, never string concatenation - Every tool has input validation, output sanitization, and timeouts - Code execution tools run in sandboxed containers with no network - Conversation memory is encrypted with per-tenant keys - Vector store queries enforce document-level access control - Output guardrails validate responses before delivery - LangSmith tracing captures all chain executions - Circuit breakers protect against tool failures - Cost controls cap token usage per session and per user - API keys are managed through a secrets manager - Network policies restrict outbound connections
How Masarrati Builds LangChain Agents
At Masarrati, we've built production LangChain agents for enterprise clients handling sensitive data in healthcare, fintech, and cybersecurity. Every agent we deploy follows the security patterns outlined in this guide — because in production, security isn't a feature, it's a requirement.
Our Hawkeye XDR platform demonstrates how we build AI systems that process millions of security events while maintaining strict data isolation and access controls. The same engineering discipline applies to every LangChain agent we deploy.
Schedule a consultation to discuss your AI agent architecture.