What is the difference between prompt engineering and middleware for PII?

Prompt engineering asks the LLM to ignore or hide data, which can be bypassed. Middleware physically removes or masks the data before the LLM ever sees it, providing a hard security guarantee.

How do I create my own custom middleware in LangChain?

You can use the wrap_tool_call decorator to wrap agent tool executions, allowing you to run custom code before and after a tool is triggered.

Does middleware affect the performance of the AI agent?

While every layer adds a small amount of overhead, middleware is designed to be lightweight. The security and compliance benefits usually far outweigh the negligible latency increase.

Controlling AI Agents with LangChain Managed Deep Agents…

Learn how to use LangChain's middleware for Managed Deep Agents to implement PII redaction, custom logging, and policy enforcement for secure AI agents.

Imagine building a brilliant AI agent that can handle customer support, only to realize it's accidentally sending sensitive customer emails directly into a third-party LLM's training set. It's a nightmare scenario for any developer tasked with security and compliance.

⚡ TL;DR: LangChain's middleware for Managed Deep Agents allows developers to intercept and modify an agent's lifecycle. Using tools like the prebuilt PIIMiddleware or the wrap_tool_call decorator, you can redact sensitive data and enforce custom policies before data ever reaches the LLM or LangSmith.

The Simple Version

In the world of software, middleware is like a series of checkpoints that a request must pass through before it reaches its final destination. Instead of the user talking directly to the AI, the request passes through these checkpoints first.

Each checkpoint can do something specific: one might check if the user is allowed to ask the question, another might scrub out credit card numbers, and another might log the request for the developers to see later.

🎯 Think of it this way: Imagine an airport security line. You don't just walk from the curb onto the plane. You go through a ticket check, a security scanner, and a passport control. Each of these is a piece of 'middleware' ensuring you are safe and authorized before you reach the aircraft.

How It Actually Works

Managed Deep Agents provide a structured way to handle complex AI workflows. Middleware plugs into this structure, allowing you to extend the agent's lifecycle without rewriting the core logic of the agent itself.

Prebuilt Policy Enforcement

LangChain provides out-of-the-box solutions for common enterprise problems. A prime example is the PIIMiddleware, which is designed to handle Personally Identifiable Information (PII).

When a user submits a prompt containing an email address, the PIIMiddleware intercepts that string. It redacts the sensitive information before it is sent to the LLM, ensuring that private data never leaves your controlled environment.

The Lifecycle Interception

Without middleware, an agent follows a baseline behavior: it takes an input, processes it via the LLM, calls a tool, and returns a result. This is a direct line with no filters.

With middleware added to the agent definition, you create a wrapper around that process. This allows you to implement fault tolerance (retrying failed calls) or rate limiting to prevent your API costs from skyrocketing during a traffic spike.

🎯 Think of it this way: It's like adding a 'filter' to a water pipe. The water (your data) still flows to the faucet (the LLM), but the filter catches the impurities (PII) along the way so only clean water gets through.

Technical Deep Dive

For developers, the real power lies in the ability to create custom middleware. LangChain achieves this through a specific mechanism called the wrap_tool_call decorator.

Custom Middleware with wrap_tool_call

The wrap_tool_call decorator allows you to wrap the execution of an agent's tool. This means you can execute code immediately before a tool is called and immediately after it returns a value.

In the demo provided by Nathan Drezner, this is used to build a custom logging middleware. By wrapping the tool call, the developer can capture the exact arguments being passed to a tool and the resulting output, sending them to a custom internal logging system.

Integration and Observability

One of the most critical technical benefits of this architecture is its relationship with LangSmith. Because the middleware sits before the LLM call, the redaction happens upstream.

When using PIIMiddleware, the redacted version of the text is what gets sent to the LLM and, consequently, what is logged in LangSmith. This means your observability traces remain clean and compliant, as the sensitive data never even enters the tracing system.

Adding Middleware to the Agent Definition

Implementing these checks doesn't require a complete architectural overhaul. You simply add the middleware classes to the agent's definition. This modular approach means you can toggle security policies on or off depending on the environment (e.g., disabling strict PII redaction in a local dev environment but enforcing it in production).

Why This Matters

For a long time, the gap between a 'cool AI demo' and a 'production-ready enterprise app' was huge. The biggest hurdle was trust. Companies are terrified of leaking proprietary data or violating GDPR and HIPAA regulations.

Managed Deep Agents middleware bridges this gap by moving security from a 'hope for the best' prompt-engineering strategy to a 'hard-coded' architectural guarantee. You are no longer just asking the LLM to 'please not share this email'; you are physically removing the email from the request.

Furthermore, as agents become more autonomous—calling more tools and making more decisions—the need for guardrails increases. Middleware provides the programmatic control necessary to ensure that agents stay within their operational boundaries, making AI deployments safer and more scalable.

Controlling AI Agents with LangChain Managed Deep Agents Middleware

Key takeaways