Notifications
Clear all
Topic starter
18/08/2026 2:43 pm
TL;DR: LangChain Deep Agents simplifies long-running, planning-driven AI agents on LangGraph, but TruFoundry’s analysis says the real production gap is governance: centralized credential control, model-level RBAC, fleet-wide observability, and deployment boundaries still sit outside the harness. For organisations scaling AI agents, the missing layer is not orchestration code but identity, policy, and operating control.
NHIMG editorial — based on content published by TruFoundry: LangChain Deep Agents vs. Production Reality: What's Actually Missing
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern AI models that can call tools and access data?
A: Security teams should govern AI models as non-human identities with named owners, limited scope, short-lived credentials, and continuous authorization.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: What breaks when agent credentials are delivered only at the application layer?
A: Application-layer delivery breaks down when multiple workloads share infrastructure or when agent code changes faster than security controls.
Practitioner guidance
- Separate orchestration from governance Keep the agent harness focused on planning and execution, but enforce model access, tool permissions, and deployment rules in a central control plane.
- Register every agent credential as an NHI asset Inventory model keys, MCP credentials, and delegated tokens the same way you inventory service accounts and API keys.
- Set team-scoped policy before scale-out Define which team can use which model, connect to which tool, and access which skill before the first cross-team rollout.
What's in the full article
TruFoundry's full article covers the operational detail this post intentionally leaves for the source:
- A side-by-side explanation of how Deep Agents differs from LangGraph at the implementation level.
- Specific governance patterns for AI Gateway, MCP Gateway, Agent Gateway, and Agent Harness deployment.
- Details on model-level RBAC, per-team budget controls, and delegated MCP credentials in practice.
- Deployment options across SaaS, self-hosted, VPC, and on-prem environments.
👉 Read TruFoundry's analysis of LangChain Deep Agents and production governance gaps →
LangChain Deep Agents and the governance gap teams are missing?
Explore further
18/08/2026 3:26 pm
Agent orchestration without central governance is an identity control gap, not a product gap. The article shows that Deep Agents solves execution design, but leaves model access, MCP credentials, and team-scoped policy to the customer. That means the hard part shifts from coding agents to governing who and what they can reach. For identity teams, the lesson is that agent frameworks are only production-capable when the control plane exists above the harness, not inside it.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do you know whether an agent platform is production-ready for enterprise use?
A: Look for central model RBAC, delegated tool credentials, fleet-wide observability, cost reporting by agent and team, and deployment options that match your data and residency constraints. If those controls are missing, the platform is still an execution layer, not a governance layer.
👉 Read our full editorial: LangChain Deep Agents expose the production gap in AI governance
