LangChain Integration

Add deterministic governance to your LangChain agents with a single middleware. Policy enforcement, PII detection, prompt injection blocking, cost limits, tool authorization, secret scanning, circuit breakers, and structured audit evidence — no LLM in the governance path.

Package: langchain-tealtiger on PyPI
License: Apache 2.0
Latency: Under 5ms per evaluation
Source: GitHub

Installation

pip install langchain-tealtiger

This installs the full TealTiger governance engine as a dependency — all capabilities are available through the middleware.

Quick Start

from langchain.agents import create_agent
from langchain_tealtiger import TealTigerMiddleware

agent = create_agent(
    model="claude-sonnet-4-6",
    tools=[search, calculator, file_write],
    middleware=[
        TealTigerMiddleware(
            policies=[
                {"type": "tool_allowlist", "tools": ["search", "calculator"]},
                {"type": "pii", "action": "REDACT"},
                {"type": "cost_limit", "max_per_session": 5.00},
                {"type": "prompt_injection", "action": "BLOCK"},
                {"type": "secrets", "action": "BLOCK"},
            ],
            freeze_tools=["rm_rf", "drop_database"],
        )
    ],
)

Every tool call, model input, and model output now flows through deterministic governance evaluation.

Multi-Stage Defense

TealTiger doesn’t just govern tool calls — it protects at every stage of the agent lifecycle automatically:

User Input → [Stage 1: Input Defense] → Model → [Stage 2: Output Defense]
                                                        ↓
                                               Tool Call → [Stage 3: Pre-Tool Defense]
                                                        ↓
                                               Tool Result → [Stage 4: Post-Tool Defense]

LangChain Hook	Defense Stage	What Runs
`before_agent`	Session init	Initialize governance session, load policies
`before_model`	Input defense	PII scan, prompt injection blocking, content moderation
`after_model`	Output defense	Response PII scanning, secret detection, content classification
`wrap_tool_call`	Pre-tool defense	Tool authorization, argument validation, cost check
`after_tool`	Post-tool defense	Tool output scanning, secret detection, PII in results
`after_agent`	Session close	Finalize evidence trail, emit audit summary

All stages activate from a single middleware instance — no per-stage configuration needed.

Learn more about the multi-stage defense architecture in the concepts guide.

Governance Capabilities

PII Detection

Scans inputs, outputs, and tool arguments for 40+ PII patterns in under 2ms:

TealTigerMiddleware(
    policies=[
        {
            "type": "pii",
            "action": "REDACT",          # BLOCK | REDACT | FLAG
            "patterns": "all",           # or: ["ssn", "credit_card", "email", "phone", "iban"]
            "stages": ["input", "output", "tool_result"],
        }
    ],
)

Detected patterns include: SSN, credit card numbers, IBAN, phone numbers, email addresses, IP addresses, AWS keys, passport numbers, driver’s license, dates of birth, and 30+ more. Each detection includes a confidence score (0.0–1.0).

Prompt Injection Detection

Deterministic pattern matching for common injection attacks — no LLM needed:

TealTigerMiddleware(
    policies=[
        {
            "type": "prompt_injection",
            "action": "BLOCK",            # BLOCK | FLAG | MONITOR
            "sensitivity": "high",        # low | medium | high
        }
    ],
)

Catches: instruction override attempts, role manipulation, jailbreak patterns, system prompt extraction, and context manipulation.

Secret Scanning

Detects leaked secrets and credentials in model inputs/outputs:

TealTigerMiddleware(
    policies=[
        {
            "type": "secrets",
            "action": "BLOCK",
            "patterns": "all",  # 500+ patterns: AWS keys, GitHub tokens, Stripe keys, DB URLs...
        }
    ],
)

Tool Authorization

Fine-grained control over what tools agents can use and how:

TealTigerMiddleware(
    policies=[
        # Allowlist — only these tools permitted
        {"type": "tool_allowlist", "tools": ["search", "calculator", "read_file"]},

        # Blocklist — always denied
        {"type": "tool_blocklist", "tools": ["delete_file", "execute_sql", "send_email"]},

        # Argument constraints
        {
            "type": "tool_args",
            "tool": "search",
            "constraints": {"query": {"max_length": 200, "blocked_terms": ["competitor"]}},
        },
    ],
    # FREEZE — immutable deny rules, enforced regardless of governance mode
    freeze_tools=["rm_rf", "drop_database", "format_disk"],
)

Cost Governance

Hard budget enforcement — not just alerts after the fact:

TealTigerMiddleware(
    policies=[
        {
            "type": "cost_limit",
            "max_per_session": 5.00,      # $ per agent session
            "max_per_request": 0.50,      # $ per individual LLM call
            "max_daily": 100.00,          # $ per day
            "action": "BLOCK",            # hard stop when exceeded
        }
    ],
)

Cost is tracked per-model using real token pricing. When budget is exhausted, further calls are blocked.

Rate Limiting

Prevent runaway agents from exhausting resources:

TealTigerMiddleware(
    policies=[
        {"type": "rate_limit", "max_calls": 100, "window": "1h"},
        {"type": "rate_limit", "max_calls": 10, "window": "1m", "tool": "search"},
    ],
)

Circuit Breaker

Automatic failure protection — stop calling broken tools/models:

TealTigerMiddleware(
    policies=[
        {
            "type": "circuit_breaker",
            "failure_threshold": 5,       # open after 5 failures
            "recovery_time": 60,          # retry after 60s
            "half_open_calls": 2,         # test before closing
        }
    ],
)

Content Moderation

Classify and filter content by category:

TealTigerMiddleware(
    policies=[
        {
            "type": "content_moderation",
            "blocked_categories": ["hate_speech", "self_harm", "violence"],
            "action": "BLOCK",
        }
    ],
)

Governance Modes

Mode	Behavior	Use Case
`ENFORCE`	Block denied actions, redact PII	Production
`MONITOR`	Allow all, log violations	Staging / shadow testing
`REPORT_ONLY`	Allow all, generate compliance reports	Initial rollout

# Start in MONITOR to observe, graduate to ENFORCE
TealTigerMiddleware(policies=[...], mode="MONITOR")

Governance Evidence & Audit Trail

Every governance decision produces a structured Decision Contract:

middleware = TealTigerMiddleware(policies=[...])
agent = create_agent(model="...", tools=[...], middleware=[middleware])

result = agent.invoke({"messages": [HumanMessage("...")]})

# Session summary
print(middleware.summary)
# SessionSummary(total_evaluations=12, allowed=10, denied=2, session_cost=2.34)

# Full evidence trail
for decision in middleware.evidence:
    print(decision)
    # Decision(
    #   correlation_id="a1b2c3d4-...",
    #   trace_id="otel-trace-...",         ← OpenTelemetry compatible
    #   action="DENY",
    #   risk_score=85,
    #   reason_code="PII_SSN_DETECTED",
    #   stage="pre_tool",
    #   tool_name="submit_form",
    #   triggered_policies=["pii"],
    #   evaluation_time_ms=1.2,
    #   timestamp="2026-08-10T14:32:01Z",
    # )

Evidence Export

Export for compliance teams:

# JSON for SOC2/HIPAA/ISO 27001
middleware.export_evidence("governance_report.json")

# SARIF for security tooling
middleware.export_evidence("governance.sarif", format="sarif")

# JUnit XML for CI/CD
middleware.export_evidence("results.xml", format="junit")

OpenTelemetry Integration

Governance decisions propagate as OTel spans with the agent’s trace context:

TealTigerMiddleware(
    policies=[...],
    otel_enabled=True,  # Decisions appear in LangSmith, Jaeger, Datadog, etc.
)

Span attributes:

tealtiger.action: ALLOW / DENY / REDACT
tealtiger.risk_score: 0–100
tealtiger.reason_code: policy violation code
tealtiger.evaluation_ms: governance latency

Use with LangGraph

Works seamlessly in multi-agent LangGraph workflows:

from langgraph.graph import START, StateGraph
from langchain.agents import AgentState, create_agent

governed_agent = create_agent(
    model="claude-sonnet-4-6",
    tools=[search, calculator, write_file],
    middleware=[
        TealTigerMiddleware(
            policies=[
                {"type": "pii", "action": "REDACT"},
                {"type": "tool_allowlist", "tools": ["search", "calculator"]},
                {"type": "cost_limit", "max_per_session": 10.00},
                {"type": "prompt_injection", "action": "BLOCK"},
            ],
        )
    ],
)

graph = (
    StateGraph(AgentState)
    .add_node("research", governed_agent)
    .add_node("writer", governed_agent)
    .add_edge(START, "research")
    .add_edge("research", "writer")
    .compile()
)

Governance decisions are visible in LangSmith traces and respect LangGraph checkpointing.

Complete Example: Compliant Research Agent

from langchain.agents import create_agent
from langchain_tealtiger import TealTigerMiddleware

# Full governance configuration
middleware = TealTigerMiddleware(
    policies=[
        # Security
        {"type": "pii", "action": "REDACT", "patterns": "all"},
        {"type": "prompt_injection", "action": "BLOCK", "sensitivity": "high"},
        {"type": "secrets", "action": "BLOCK"},
        {"type": "content_moderation", "blocked_categories": ["hate_speech", "self_harm"]},

        # Tool governance
        {"type": "tool_allowlist", "tools": ["web_search", "calculator", "read_file"]},
        {"type": "tool_args", "tool": "web_search", "constraints": {"query": {"max_length": 200}}},

        # Cost governance
        {"type": "cost_limit", "max_per_session": 5.00, "max_daily": 50.00},
        {"type": "rate_limit", "max_calls": 50, "window": "1h"},

        # Reliability
        {"type": "circuit_breaker", "failure_threshold": 3, "recovery_time": 30},
    ],
    freeze_tools=["delete_file", "execute_sql", "shell_command"],
    mode="ENFORCE",
    otel_enabled=True,
)

agent = create_agent(
    model="gpt-4o",
    tools=[web_search, calculator, read_file],
    middleware=[middleware],
)

# Run the agent
result = agent.invoke({"messages": [HumanMessage("Research AI governance trends")]})

# Inspect governance
print(f"Evaluations: {middleware.summary.total_evaluations}")
print(f"Blocked: {middleware.summary.denied}")
print(f"Cost: ${middleware.summary.session_cost:.2f}")

# Export evidence for compliance
middleware.export_evidence("audit_trail.json")

OWASP AI Security Coverage

TealTiger addresses 7/10 OWASP Agentic Security Issues through the LangChain middleware:

OWASP ASI	Coverage	How
ASI-01: Excessive Agency	✅	Tool allowlist/blocklist, FREEZE rules
ASI-02: Inadequate Sandboxing	✅	Argument validation, action constraints
ASI-03: Prompt Injection	✅	Deterministic injection pattern detection
ASI-04: Sensitive Information Disclosure	✅	PII detection + redaction (40+ patterns)
ASI-05: Improper Output Handling	✅	Output scanning, content moderation
ASI-07: Inadequate Error Handling	✅	Circuit breaker, structured error responses
ASI-09: Insufficient Monitoring	✅	Full audit trail with correlation IDs

Key Properties

Property	Detail
Deterministic	No LLM in governance path — same input, same decision
Fast	Under 5ms per evaluation, full multi-stage under 15ms
Multi-stage	Input → output → pre-tool → post-tool in one middleware
Auditable	Full evidence trail with correlation IDs, SARIF/JUnit/JSON export
OTel-native	Spans propagate through existing OpenTelemetry traces
Graph-native	Works with LangGraph, visible in LangSmith
Composable	Drop into any agent, works with subgraphs
Zero external deps	All evaluation in-process, no API keys needed

Troubleshooting

Policies not enforcing

Check your governance mode. In MONITOR mode, violations are logged but not blocked:

TealTigerMiddleware(policies=[...], mode="ENFORCE")  # Not "MONITOR"

Tools not being governed

Ensure you’re using the middleware parameter when creating the agent:

agent = create_agent(model="...", tools=[...], middleware=[middleware])

High costs despite limits

Verify cost policies use "action": "BLOCK" (not "FLAG"):

{"type": "cost_limit", "max_per_session": 5.00, "action": "BLOCK"}

Next Steps

Multi-Stage Defense

Understand how governance runs at every lifecycle stage

Governance Domains

Explore the 10 governance domains

Policy Reference

Full policy configuration reference

LangGraph Guide

Advanced multi-agent governance with LangGraph

​LangChain Integration

​Installation

​Quick Start

​Multi-Stage Defense

​Governance Capabilities

​PII Detection

​Prompt Injection Detection

​Secret Scanning

​Tool Authorization

​Cost Governance

​Rate Limiting

​Circuit Breaker

​Content Moderation

​Governance Modes

​Governance Evidence & Audit Trail

​Evidence Export

​OpenTelemetry Integration

​Use with LangGraph

​Complete Example: Compliant Research Agent

​OWASP AI Security Coverage

​Key Properties

​Troubleshooting

​Next Steps

Multi-Stage Defense

Governance Domains

Policy Reference

LangGraph Guide

LangChain Integration

Installation

Quick Start

Multi-Stage Defense

Governance Capabilities

PII Detection

Prompt Injection Detection

Secret Scanning

Tool Authorization

Cost Governance

Rate Limiting

Circuit Breaker

Content Moderation

Governance Modes

Governance Evidence & Audit Trail

Evidence Export

OpenTelemetry Integration

Use with LangGraph

Complete Example: Compliant Research Agent

OWASP AI Security Coverage

Key Properties

Troubleshooting

Next Steps