Risk accumulates as state moves through the workflow
Prompt filtering sees the request at the front door. Graph and RAG systems keep making decisions after that moment: which source to trust, which edge to follow, which specialist to invoke, which tool to call, and which partial result to stream. Any one of those choices can create impact.
AgenticDome brings tenant policy to the points where workflow state changes meaning. LangGraph nodes and transitions, LangChain middleware, and LlamaIndex tool, retriever, query, and postprocessor boundaries become places to allow, block, sanitize, or route safely—with the same actor, agent, purpose, and session context carried across the journey.
What changes when AgenticDome is in the path
Sensitive paths cross an AgenticDome node, wrapper, middleware, or sanitizer before they advance. A blocked transition routes to a non-executing state; unsafe retrieved content is handled before it becomes model context; tools execute only after authorization; configured streams and final output are reviewed before release.
Why graph and RAG teams use AgenticDome
AgenticDome turns a collection of framework hooks into a coherent operating model: protect the state transition, preserve the lineage, and make the final action answer to the same tenant policy wherever it occurs.
Control risky transitions
Gate the move from low-impact reasoning to privileged retrieval, specialist delegation, or side-effecting tools instead of trusting every graph edge equally.
Treat retrieval as untrusted input
Review retrieved documents and nodes before they become model context or customer output, reducing the chance that poisoned content becomes the next instruction.
Preserve intent across steps
Carry stable user or workload identity, agent identity, purpose, session, and delegation context from ingress to the tool that creates impact.
See one decision story
Give platform and assurance teams tenant-scoped evidence across input, route, retrieval, tool, delegation, stream, and output checkpoints.
Use the integration shape your graph already has
Teams that own a LangGraph topology can add explicit security nodes or wrap existing nodes. LangChain create_agent users can install middleware. LlamaIndex teams can protect tools, query engines, retrievers, postprocessors, and callbacks. AgenticDome fits the execution model rather than forcing the workflow into a new framework.
How AgenticDome creates the control point
1. Ingress
Screen the input and establish stable session, user/workload, agent, and purpose context.
2. Route or transition
Gate sensitive graph edges and prevent blocked state from falling through.
3. Retrieval
Review retrieved nodes or documents before they become trusted model context.
4. Tool and delegation
Authorize typed functions and verify protected specialist execution before side effects.
5. Stream and output
Review supported streaming events and final synthesized content before delivery.
What this changes for real teams
Stop poisoned context before it becomes “truth”
“Our sources have different trust levels, yet the model receives retrieved chunks as context for its next decision.”
AgenticDome contribution: AgenticDome retrieval sanitizers and LlamaIndex wrappers review configured content before planner reuse, while source authorization, provenance, index security, and quality controls remain in place.
Make sensitive edges explicit controls
“A workflow should not move from triage to a privileged tool merely because the model selected that route.”
AgenticDome contribution: Use security nodes or wrappers at input, sensitive transitions, tools, and output. A denied decision can route to a safe state instead of falling through to the next executable node.
Go beyond schema-valid tools
“Typed arguments prove shape, not business authority.”
AgenticDome contribution: AgenticDome wraps the application-owned callable so policy can evaluate actor, agent, purpose, tool, and sanitized arguments immediately before the real function runs.
The risks this helps contain
| Risk | Why it matters | Public AgenticDome control |
|---|---|---|
| Poisoned retrieval | Compromised or irrelevant content can influence later model and tool decisions. | Review configured documents/nodes before prompt assembly and retain source trust, provenance, and index-access controls. |
| Graph-edge bypass | One route to a raw tool can invalidate an otherwise protected topology. | Place security nodes before compile, audit all edges, and route blocked state away from execution. |
| Schema-valid misuse | Type correctness does not establish business purpose or authority. | Authorize tool name, sanitized arguments, actor, agent, session, and purpose immediately before the local callable. |
| Delegation without authority | A graph transition or handoff can move work to a more capable specialist. | Authorize manager handoff and verify the matching protected specialist execution where the documented adapter supports it. |
| Streaming disclosure | Sensitive content can leave during events before final-output review. | Use documented streaming sanitizers and ensure raw event streams are not returned through an alternate path. |
A practical path to production
Draw the topology
List every route from input to model, retrieval, tool, specialist, stream, and output.
Choose hard boundaries
Use nodes/wrappers for execution control; use callbacks as supporting visibility where documented.
Protect RAG twice
Authorize the read and review retrieved content before model reuse or customer delivery.
Test bypass routes
Exercise blocked edges, raw executors, retries, streams, and exception paths before launch.
Where this control ends
Only graph edges, nodes, middleware, tools, retrievers, query engines, callbacks, and output paths that the application actually secures are covered. AgenticDome does not validate source truth, guarantee retrieval quality, replace vector-store access control, secure a remote provider’s internal execution, or protect a raw node reached through an alternate edge.
Current lifecycle note
LangChain now recommends create_agent() with middleware for its standard agent loop. Existing LangGraph StateGraph applications can continue to use explicit security nodes or wrappers; select the attachment model that matches the runtime version actually deployed.