LangChain Security and Guardrails: Prompt Injection, Data Boundaries and Safe Tools

Prompt Injection Defense

LLM applications introduce security risks that normal web apps do not have. Retrieved documents can contain malicious instructions. Users can try to override system prompts. Tools can perform actions the model should not control freely. Guardrails are the engineering boundaries around those risks.

Security in LangChain is not one feature. It is a set of choices: least-privilege tools, input validation, output schemas, retrieval permissions, prompt boundaries, human approval, logging, and refusal behavior.

Prompt injection happens when user text or retrieved documents tell the model to ignore instructions, reveal secrets, or call tools incorrectly. You cannot solve it with one sentence in the system prompt. You need layered controls.

Keep secrets out of prompts and retrieved context.
Separate instructions from untrusted data using clear delimiters.
Require authorization checks outside the model.
Use allowlists for tools and destinations.

Safe Tool Boundaries

Tools are where LLM apps can cause real-world damage. Read tools are safer than write tools. Write tools should validate arguments, check permissions, and often require human confirmation.

Design small tools with typed schemas.
Never let the model construct raw SQL, shell commands, or unrestricted URLs.
Log tool arguments, results, and user identity.

Validate Tool Arguments Outside the Model

The model can suggest a tool call, but normal code should enforce permissions.

Validate Tool Arguments Outside the Model

from pydantic import BaseModel, Field

class RefundRequest(BaseModel):
    order_id: str = Field(pattern=r"^ord_[a-zA-Z0-9]+$")
    amount_cents: int = Field(gt=0, le=50000)
    reason: str = Field(min_length=10, max_length=300)

def create_refund_tool(user, payload: dict):
    request = RefundRequest.model_validate(payload)

    if "refund:create" not in user.permissions:
        raise PermissionError("User cannot create refunds")

    # Real integration would call the payments service here.
    return {
        "status": "pending_review",
        "order_id": request.order_id,
        "amount_cents": request.amount_cents,
    }

Validation belongs in code, not only in the prompt.
High-risk actions can return pending_review instead of executing immediately.

Reject an Unapproved Tool Destination

from urllib.parse import urlparse

ALLOWED_HOSTS = {'docs.example', 'status.example'}

def allow_url(value: str) -> bool:
    parsed = urlparse(value)
    return parsed.scheme == 'https' and parsed.hostname in ALLOWED_HOSTS

print(allow_url('https://docs.example/guide'))
print(allow_url('http://169.254.169.254/latest/meta-data'))

Output

True
False

Before you move on