Integration
Guardrails & fact-checking for LangChain agents
LangChain 1.0 ships real guardrail middleware – PII redaction and human-in-the-loop approval are built in, and the hook system takes custom checks. Good primitives; use them. Their structural limit is where they run: inside each agent’s process, wired per agent, kept in sync by hand. in/guard/out moves enforcement to the wire, where one policy covers every chain and agent that talks to a model – including the ones nobody remembered to wrap.
Side by side
| Capability | LangChain 1.0 middleware | in/guard/out |
|---|---|---|
| Enforcement point | In-process, per agent, wired in code | On the wire – one integration covers every agent |
| PII detection | Built-in middleware: email, card, IP, MAC, URL | Full Presidio entity set: names, SSNs, IBANs, addresses and more |
| PII after detection | Redact / mask / hash / block – one-way | Stable placeholders, restored on the response |
| Human-in-the-loop | Built in – interrupt before designated tools (needs a checkpointer) | Approval tiers at the checkpoint API, outside the agent process |
| Hallucination & grounding | — | Deterministic numeric grounding + fact-check judge |
| Prompt injection defense | Custom middleware you write | Patterns + classifier + tool-result scanning, built in |
| Tool-call policy | Per-tool interrupts you configure | Allow/deny, JSON-schema args, risk tiers, action grounding, taint |
| Cross-run state (budgets, loops, sequences) | — (middleware sees one call at a time) | Per-run budgets, loop guard, sequence policies over the whole run |
| Coverage of unwrapped code paths | — (unwrapped = unguarded) | Anything calling the model crosses the pipeline |
| Audit trail | Your logging, per app | One run graph per task: model calls, tools, checkpoints, cost |
| Enforcement independence | Shares the process it polices | Outside the agent’s reach – a compromised agent can’t skip it |
Middleware and the wire, working together
Two touchpoints cover the whole loop. Model calls go through in/guard/out via the standard base-URL swap on your chat model – PII screening, injection defense, grounding, and tool-call policy run on every request without touching your chains. Tool execution consults the checkpoint API through a callback handler, so the deterministic steps an LLM proxy cannot see – the HTTP call your tool actually makes – are gated by the same policy engine.
This is not a rip-out-your-middleware argument. LangChain’s PII middleware is a fine first pass inside the process, and its human-in-the-loop interrupt is genuinely useful in development. What the wire adds is what in-process code structurally cannot: enforcement that survives a compromised or buggy agent, state that spans the whole run rather than one call, and coverage that doesn’t depend on every team remembering to attach every middleware to every agent.
The model-call side is a constructor argument
llm = ChatOpenAI(
base_url="https://api.inguardout.com/v1",
api_key="gr-…",
model="gpt-4o",
default_headers={"X-Guardrails-Session-Id": run_id},
)Setting it up with in/guard/out
1. Point the model at in/guard/out
Set base_url and your in/guard/out key on ChatOpenAI (or any OpenAI-compatible model class). Every LLM call in every chain now runs the pipeline.
2. Add the session header
Pass X-Guardrails-Session-Id per task so the agent’s many requests group into one run – one budget, one reconstructed trace in the Runs view.
3. Gate tools with the callback
Attach the guardrails callback handler so tool executions ask the checkpoint API “may I proceed?” and honor allow / deny / require-approval.
4. Observe, then enforce
Start in FIX mode, review what gets flagged in the dashboard, then flip individual checks to PREVENT per key.
Frequently asked questions
Does this replace LangChain’s built-in guardrail middleware?
It moves the enforcement point. PIIMiddleware and HumanInTheLoopMiddleware run inside each application and must be attached to each agent; in/guard/out runs on the wire and covers all of them uniformly, with cross-run state (budgets, loops, sequences) middleware cannot see. You can run both – they do not conflict.
Does it work with LangGraph?
Yes – LangGraph nodes call models through the same model classes, so the base-URL swap covers them, and graph nodes that execute consequential steps can consult the checkpoint API like any tool.
What about streaming chains?
Streaming is buffered in the current version – guardrails need the complete output to judge it. Chains work unchanged; tokens arrive when the response has passed.
Which checks apply to agent tool calls?
The full agent stack: tool allow/deny with schema validation, permission tiers, action grounding, taint tracking, loop guard, budgets, and optional sequence policies – based on the tool_calls in the model responses crossing in/guard/out.
Related
Wire it into LangChain in two touchpoints
Swap the base URL on your chat model and add the checkpoint callback - then one run graph covers every chain. We are running a limited demo - sign up and we will get you in as soon as we can.