Announcing the Watchlight AI Beacon Plugin for LangChain Deep Agents: Governing the Long-Horizon Loop

Bottom line. Watchlight AI Beacon now governs agents built on LangChain's deepagents. Every tool call, every filesystem operation, and every sub-agent action is authorized against current policy before it runs. Each sub-agent runs under its own explicit, narrowed authority that you define, never authority inherited from the agent that spawned it, so delegation does not become privilege escalation. An action that violates policy is stopped before it executes, before the request ever reaches the wire. A flagged agent can be halted mid-run, the whole run and its sub-agent tree land in a tamper-evident record, and an optional network proxy governs the outbound traffic the in-process layer cannot see. Integration is a drop-in: swap one import, no changes to your tool code.

A few days ago we argued that an AI agent is really a loop, and that the loop is the real unit of risk. LangChain's deep agents are that argument in its sharpest form. A deep agent does not answer once and stop. It plans, works through a task over many steps, keeps a virtual filesystem of its own work, and delegates pieces of the job to sub-agents that have their own reasoning loops. That is what makes deep agents capable of real, long-horizon work. It is also exactly what makes runtime governance non-optional.

Deep agents are the loop at its sharpest

In Securing the Agentic Loop we described the three points every agent loop has to govern: the plan, each action, and the reaction to what the agent observes. A deep agent runs that loop for a long time and then forks it.

Three properties raise the stakes. The runs are long-horizon, so a small deviation or a poisoned tool result early in the task compounds into a consequential action many steps later. The agent keeps state of its own, in a working filesystem it reads back and acts on. And the work fans out: a single request becomes a tree of sub-agents, each calling tools and touching data. That fan-out is where authority quietly leaks. If governance treats every sub-agent as the agent that spawned it, a narrowly-scoped sub-agent inherits its parent's full access, and delegation becomes privilege escalation.

Governing the model inside a deep agent does not govern any of that. You have to govern the loop, on every pass, and every sub-agent it spawns.

What the plugin does

The Watchlight AI Beacon plugin for deep agents brings Beacon's governance to the full lifecycle of a deep agent run, without asking you to rewrite your tools.

Authorization before the action, on every action. Every tool call and filesystem operation, in the main agent and in each sub-agent, is evaluated against current, versioned policy the moment the agent decides to take it, before it executes. The decision is deterministic, with no language model in the trust path deciding what is allowed. A call that violates policy is stopped before it runs and before it can place a request on the wire. There is nothing to detect after the fact, because the action never happened.

Governed delegation. When a deep agent delegates part of its work to a sub-agent, that sub-agent runs under its own explicit, narrower authority that you set up front. It cannot act with privileges it was never granted, no matter what spawned it, and nested sub-agents stay bounded the whole way down.

Containment, not just refusal. Denial stops a single action. When the situation calls for stopping the agent, a flagged run can be halted mid-flight, with every further action short-circuited until a person clears it.

A provable record of the whole run. Every action, decision, and sub-agent spawn is captured as tamper-evident execution lineage, including the full delegation tree, in the same canonical record Beacon produces for every framework it supports. A deep agent and a LangGraph agent feed one dashboard.

Fail closed by design. If an action cannot be authorized, it does not run, and attempts to slip around the governance layer close rather than open. Safe behavior is defined for both directions of failure.

Two enforcement boundaries, not one

The plugin is the first boundary. It works inside the agent, at the semantic layer, where it can see the run's intent, each action, the sub-agents, and the shape of the run. That vantage point is what makes per-action authorization and per-sub-agent governance possible.

An in-process control can only govern the paths it can see. A high-authority agent that reaches outside the instrumented path, through a spawned process, a different client library, or a compromised dependency, can attempt to act where the plugin does not observe. That is why Beacon pairs the plugin with a second boundary, the enforcement proxy, which governs every outbound request on the wire. Enable it and the two layers enforce the same policy from two different vantage points. An action that evades the in-process layer still meets the proxy, and an unauthorized action has to defeat two independent controls that share one policy. This is the same defense-in-depth model behind every plugin in the Watchlight AI Beacon Plugin Suite.

Drop-in for developers, consistent for security

Governance that slows engineers down does not get adopted, so this integration is built to be nearly invisible to the teams shipping agents. You swap one import, give your agent a name, set the authority each sub-agent is allowed to hold, and set a couple of environment variables. Your tools do not change. Your agent runs the way it does today, with every action now passing through Watchlight AI Beacon before it commits.

For a platform or security team, that is the point. Governance becomes a small, standard wrapper adopted once and configured centrally, so policy lives in one place and is enforced identically across every deep agent in the organization, alongside the LangGraph, Google ADK, AWS Bedrock, MCP, Claude Agent SDK, and OpenClaw agents Beacon already governs. If you are weighing why runtime enforcement is a different discipline from securing the model, start with Securing the Agentic Loop and AI Security Is Not Enough.

Request early access

The Watchlight AI Beacon plugin for LangChain deep agents is available through the Watchlight Founding Design Partner program, our early preview. Program partners receive the plugin directly, and it will be published as it moves to general availability. If your teams are building on deep agents, or evaluating them, we will help you stand up governance against your own policies and show you the full lineage of a real run, sub-agents included, in your environment.

Watchlight AI is an independent provider and is not affiliated with, endorsed by, or sponsored by any of the third parties referenced in this post. deepagents, LangChain, and LangGraph are trademarks of LangChain. All other product names, including Google ADK, AWS Bedrock, the Model Context Protocol (MCP), the Claude Agent SDK, and OpenClaw, are the property of their respective owners and are used for identification purposes only.