@oconnectortechnology/abs-langgraph

ABS CORE Governance Adapter for LangGraph/LangChain

Wrap your LangGraph tools with enterprise-grade governance in one line of code.

Installation

npm install @oconnectortechnology/abs-langgraph

Quick Start

import { tool } from "@langchain/core/tools";
import { absGuard } from "@oconnectortechnology/abs-langgraph";
import { z } from "zod";

// 1. Define your dangerous tool
const deleteUser = tool(
  async ({ userId }) => {
    return `User ${userId} deleted from production DB.`;
  },
  {
    name: "delete_user",
    description: "Permanently deletes a user.",
    schema: z.object({ userId: z.string() }),
  }
);

// 2. Wrap with ABS governance
const protectedDelete = absGuard(deleteUser, {
  policy: "gdpr-right-to-erasure",
  riskLevel: "critical"
});

// 3. Use in your LangGraph agent
const tools = [protectedDelete];

Configuration

interface ABSConfig {
  policy: string;                    // Required: policy tag
  riskLevel?: "critical" | "high" | "medium" | "low";
  runtimeUrl?: string;               // Default: https://api.abscore.app
  apiKey?: string;                   // Default: process.env.ABS_API_KEY
  agentId?: string;                  // Default: "langgraph-agent"
  shadowMode?: boolean;              // Log without blocking
}

Environment Variables

ABS_API_KEY=your-api-key
ABS_RUNTIME_URL=https://api.abscore.app  # optional
ABS_AGENT_ID=my-agent                     # optional

Batch Protection

import { absGuardAll } from "@oconnectortechnology/abs-langgraph";

const protectedTools = absGuardAll([tool1, tool2, tool3], {
  policy: "financial-strict"
});

Factory Pattern

import { createABSGuard } from "@oconnectortechnology/abs-langgraph";

const financialGuard = createABSGuard({
  policy: "financial-strict",
  riskLevel: "critical"
});

const safeTool = financialGuard(dangerousTool);

How It Works

1. INTERCEPT: Tool call is captured before execution
2. VALIDATE: Request sent to ABS Runtime for policy check
3. JUDGMENT: Runtime returns ALLOWED or DENIED with audit proof
4. EXECUTE: If allowed, original tool runs. If denied, error is thrown.

Fail-Close

If ABS Runtime is unreachable, the tool is blocked by default. This ensures no action executes without governance approval.

Shadow Mode

Enable shadow mode to log violations without blocking:

absGuard(tool, {
  policy: "pii-protection",
  shadowMode: true  // Violations logged, not blocked
});

License

Apache-2.0