watchlight-langgraph

Governed LangGraph agents with Watchlight — authorize every agent action, fail-closed, with zero infrastructure.

pip install watchlight-langgraph

Independent third-party plugin. This is an independent integration built by Watchlight AI. It is not affiliated with, endorsed by, or sponsored by LangChain. LangGraph and related names are trademarks of LangChain, used here nominatively only to describe compatibility.

What it does

watchlight-langgraph puts a Watchlight authorization decision in front of every action your LangGraph agent takes — tool calls, plan steps, and sub-agent spawns — so each one is allowed, modified, or denied before it runs. It's open-source glue: a thin, framework-specific layer that threads Watchlight's governance primitives into your graph topology. The actual policy decisions run on Watchlight's compiled engine, either in-process for local development or against the governed control plane in production.

Quickstart

Point the plugin at a backend and wrap your run. Your agent code doesn't change — only the backend does.

For local development, the zero-infrastructure Developer Edition runs the compiled engine in-process (requires the watchlight-engine package):

pip install watchlight-langgraph watchlight-engine

from watchlight_langgraph import WatchlightLangGraphPlugin
from watchlight_core import InProcessClient

# A Cedar policy: the research agent may read, nothing else.
POLICIES = [
    {"name": "reader",
     "code": 'permit(principal == Agent::"research-agent", action == Action::"read", resource);'},
]

plugin = WatchlightLangGraphPlugin()
plugin.apdp = InProcessClient(POLICIES)   # decisions run in-process, no server, no network

async def run_agent(question: str):
    async with await plugin.start_run(agent_slug="research-agent") as handle:
        # Validate a multi-step plan ahead of execution (Allow / Modify / Deny).
        result = await handle.submit_plan(["read dataset", "summarize"])
        if result.is_deny():
            raise PermissionError(f"Plan denied: {result.violations}")

        # Gate each action authoritatively. Returns True on Allow, False on Deny.
        if not await handle.authorize_action("read", "dataset"):
            raise PermissionError("Denied by policy")

        # ... your LangGraph agent runs, every action governed ...

authorize_action fails closed: a denial — or an unreachable backend — returns False, so the action never runs.

Attributing runs to an AI application

Every governed run can be attributed to the AI application the agent belongs to. Pass application_id="<application UUID>" to WatchlightLangGraphPlugin(...), or per run to start_run(...), or set WATCHLIGHT_APPLICATION_ID in the environment — an explicit argument wins over the env var. The id is sent on session create and bound to the run credential and to every sub-agent the run spawns; wl-apdp refuses the session if the agent is not a member of that application. An agent in exactly one application needs nothing here. The id is explicit configuration, never inferred from prompts or names, and it is an Enterprise feature: the in-process Developer Edition engine refuses it.

Two backends, same code

Moving from local to production is a one-line change:

from watchlight_core import ApdpClient

plugin = WatchlightLangGraphPlugin()
plugin.apdp = ApdpClient("https://apdp.your-company.example", api_key="...")

Links

• Documentation: https://docs.watchlight.ai/de
• Website: https://watchlight.ai

License

Apache-2.0