LangChain Deep Agents and the governance gap teams are missing

TL;DR: LangChain Deep Agents simplifies long-running, planning-driven AI agents on LangGraph, but TruFoundry’s analysis says the real production gap is governance: centralized credential control, model-level RBAC, fleet-wide observability, and deployment boundaries still sit outside the harness. For organisations scaling AI agents, the missing layer is not orchestration code but identity, policy, and operating control.

NHIMG editorial — based on content published by TruFoundry: LangChain Deep Agents vs. Production Reality: What's Actually Missing

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

Questions worth separating out

Q: How should security teams govern AI models that can call tools and access data?

A: Security teams should govern AI models as non-human identities with named owners, limited scope, short-lived credentials, and continuous authorization.

Q: Why do AI agents create more governance risk than ordinary integrations?

A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.

Q: What breaks when agent credentials are delivered only at the application layer?

A: Application-layer delivery breaks down when multiple workloads share infrastructure or when agent code changes faster than security controls.

Practitioner guidance

• Separate orchestration from governance Keep the agent harness focused on planning and execution, but enforce model access, tool permissions, and deployment rules in a central control plane.
• Register every agent credential as an NHI asset Inventory model keys, MCP credentials, and delegated tokens the same way you inventory service accounts and API keys.
• Set team-scoped policy before scale-out Define which team can use which model, connect to which tool, and access which skill before the first cross-team rollout.

What's in the full article

TruFoundry's full article covers the operational detail this post intentionally leaves for the source:

• A side-by-side explanation of how Deep Agents differs from LangGraph at the implementation level.
• Specific governance patterns for AI Gateway, MCP Gateway, Agent Gateway, and Agent Harness deployment.
• Details on model-level RBAC, per-team budget controls, and delegated MCP credentials in practice.
• Deployment options across SaaS, self-hosted, VPC, and on-prem environments.

👉 Read TruFoundry's analysis of LangChain Deep Agents and production governance gaps →

LangChain Deep Agents and the governance gap teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →