Topic starter
19/08/2026 3:55 pm
TL;DR: Production AI teams are now dealing with a multi-layer stack rather than a single framework, according to TruFoundry’s comparison showing LangChain builds LLM applications, LangGraph adds stateful agent orchestration, and LangSmith provides tracing and evaluation. The governance gap is no longer the code path alone, but the access, observability, and policy controls around agents as they branch, loop, and call tools.
Editorial analysis by NHI Mgmt Group, based on content published by TruFoundry: “LangChain vs LangGraph vs LangSmith: What's the Difference in 2026”.
Key questions
Q: How should teams govern AI agents that span LangChain, LangGraph and LangSmith?
A: Treat the stack as three different control layers.
Q: Why do stateful agent frameworks create more operational risk than simpler LLM workflows?
A: Stateful agent frameworks increase risk because each step can influence later decisions, so errors, bad inputs, or poor tool choices can compound across the run.
Q: What are the signs that AI agent lifecycle controls are failing?
A: Common signals include undocumented agents, unclear ownership, persistent tokens, broad permissions that exceed task scope, and retired agents that still have live integrations.
Practitioner guidance
- Define control points for each agent layer Separate build-time composition, runtime orchestration and post-execution tracing into distinct governance responsibilities so policy does not blur across the stack.
- Scope tool permissions per agent step Treat each tool call as a governed action with its own entitlement boundary, especially where a stateful graph can branch or repeat execution.
- Instrument agent traces for incident review Capture run trees, nested calls and checkpoint transitions so you can reconstruct agent behaviour and investigate unexpected tool use quickly.
Bottom line: LangChain, LangGraph and LangSmith solve different layers of the agent stack, but the governance problem emerges when teams assume composition, orchestration and tracing are equivalent to control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:31 pm
Agent frameworks create a governance stack, not just a software stack. The article makes clear that LangChain, LangGraph and LangSmith solve different layers of the same system, which is exactly why control failure now happens across composition, orchestration and observability. Security teams should stop reviewing agent projects as though they were single applications and start treating them as multi-layer control planes. The practitioner conclusion is that governance must be layered as deliberately as the framework stack itself.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between agent observability and agent authorisation?
A: Agent observability shows what an identity did after access began, while authorisation decides whether that identity should have had access and how much. In production, authorisation is the preventive control and observability is the detective one. They solve related problems, but they are not interchangeable.
👉 Read our full editorial: LangChain, LangGraph and LangSmith: the governance gap in agent stacks