Skip to main content
Your LangChain agent has permission to act. That’s not the same as having authority. 
Langchain Nuggets Demo
Most teams building LangChain agents spend a lot of time on access. Which systems can the agent reach? Which credentials does it need? What does the IAM policy look like? Access is the right problem to solve. But it’s only half the problem. Once an agent has access, something else takes over: the agent decides what to do with it. And most production stacks have nothing in place to govern that decision at runtime. An agent authorised to call a KYC tool can call it on any customer, for any stated reason, as many times as the model decides. It can call tools it was never meant to use if they’re reachable. It can act on behalf of one org while carrying credentials from another, with no record of what authority it was actually operating under. IAM didn’t cause any of this. IAM just wasn’t built to handle it. Nuggets is the trust infrastructure layer for autonomous AI, built to govern what agents actually do at the point of execution. Today we’re shipping langchain-nuggets, a Python and TypeScript package that brings that enforcement into LangChain and LangGraph. And unlike tool-auth layers, it doesn’t just decide and log. Every allowed action leaves a proof that a third party can verify for themselves, even across organizations and clouds. Installing it Shell
pip install langchain-nuggets Shell
npm install @nuggetslife/langchain-nuggets What it does langchain-nuggets adds a middleware layer that intercepts every tool call before it runs. It builds an ActionContext from the call, sends it to Nuggets’ authority evaluation endpoint, and either allows or blocks execution. If the call is allowed, a cryptographically signed proof artifact is emitted. If it’s blocked, the tool never runs. Five checks happen on every call: whether the delegation is still valid (not_revoked), whether it hasn’t expired (expiry_valid), whether the tool is in scope (tool_allowed), whether the target is permitted (target_allowed), and whether the invocation cap has been hit (cap_invocations). Revocation takes effect immediately, revoking a delegation blocks the agent’s next call with no grace period. That’s also how consent is enforced: withdraw consent, revoke the delegation, and the agent is stopped at the next call. There’s also intent binding. The agent declares a business intent alongside the tool call, and that intent is hashed into the proof artifact. Same tool, same parameters, different declared intent produces a different hash. You can’t reinterpret what an agent claimed it was doing after the fact. The proof is private by design. It references hashes of parameters and results, not the raw data. Auditable without being surveillance. The part other tools don’t do Access decides what systems your agent can reach. Authority decides whether this specific action, for this user, right now, is one it’s allowed to take, and leaves a cryptographic proof that it was. Other auth layers govern what your agent can do inside your stack. langchain-nuggets governs what it can do anywhere. Every allowed action carries a signed Action Receipt that a partner, an auditor, or a system on another cloud can verify for themselves, without access to your systems and without trusting your logs. The proof travels with the agent, across companies, vendors, and clouds, and it traces back through a verified chain to the human who ultimately authorised the action. In production, receipts are signed with RS256 against Nuggets’ published public key and verify independently without a callback to any Nuggets service. Running the demo The cross-org authority demo is in the repo and runs entirely locally, no Nuggets account needed, against a bundled mock authority, exercising the real SDK auth path. The same flow is validated end-to-end against the live Nuggets backend in the smoke tests. Shell
pip install langchain-nuggets fastapi uvicorn httpx python-multipart
cd examples/python/cross_org_authority
python run_demo.py Note: run from inside the example directory, not the repo root. The demo covers seven scenarios: an ALLOW on an in-scope tool call, four DENY paths (out-of-scope tool, invocation cap exceeded, expired delegation, revoked delegation), intent binding showing the hash change, and a local proof verification step. The local demo uses an HMAC stand-in for signing; production uses RS256 with a published public key. A note on the cross-org scenario The demo sets up Acme Corp delegating scoped access to a partner org’s agent, capped at three invocations, expiring, revocable. The partner agent’s DID is bound to every proof. Acme can pull the delegation at any point and the next call is blocked. This is the scenario that comes up most in enterprise AI deployments: two orgs sharing an agent workflow where one needs to stay in control of what the other’s agent can actually do. Standard IAM handles the access grant. It doesn’t handle the runtime enforcement, the authority chain, or the audit trail. What’s next langchain-nuggets 1.0.0 is live on PyPI and npm. The repo is at github.com/NuggetsLtd/langchain-nuggets. If you’re building LangChain or LangGraph agents where actions have consequences, multi-user, cross-org, regulated data, anything that has to pass a security review, contact us here. Don’t just give your agent access. Prove it had authority. Watch the demo below.