Questions
12 of 24
1What is a Tool in LangChain and how does it differ from a plain function or API call?
2What is the difference between the tool() helper, DynamicTool, and StructuredTool class?
3How does an LLM decide which tool to call — what role does the tool description play?
4What is the role of Zod schema in tool definitions and how does it map to OpenAI's function calling spec?
5What is a ToolNode in LangGraph and how does it differ from calling a tool manually inside a graph node?
6How do you wrap a REST API call with auth headers inside a Tool in TypeScript?
7How do you handle async errors and retries inside a Tool without crashing the agent loop?
8How do you pass runtime context (userId, authToken, DB connection) into a Tool using RunnableConfig?
9How do you build a Toolkit (grouped set of related tools) using BaseToolkit?
10How do you validate and sanitize tool output before it is passed back to the LLM?
11How do you stream tool call results back to the client in real time?
12How do you implement tool-level authorization — allowing certain tools only for certain users?
13How do you build stateful tools that read/write to a database across multiple agent turns?
14How do you prevent tool abuse or infinite loops where an agent keeps calling the same tool repeatedly?
15How do you implement parallel tool calling — when the LLM decides to call multiple tools simultaneously?
16How do you create a human-in-the-loop tool that pauses the agent and waits for user approval before executing?
17How do you unit test and mock tools in isolation without invoking the LLM?
18How do you implement tool call caching to avoid redundant API calls for identical inputs?
19How do you design a multi-agent system where one agent's tool is actually another agent (agent-as-tool pattern)?
20How does LangGraph's ToolNode handle tool call errors and surface them back into the message state?
21What is the difference between tool_choice: "auto", "required", and "none" when binding tools to an LLM?
22How do you implement dynamic tool loading — where the set of available tools changes based on user role or session state?
23How do you trace and observe tool call latency in production using LangSmith?
24What are the token cost implications of registering too many tools and how do you mitigate it?
langchainlangchain
Basics
Agents
Models
Messages
Tools
Middleware
Memory
MCP
Multi Agents
RAG
Context Engineering
Human in the loop
12 / 24

How do you implement tool-level authorization — allowing certain tools only for certain users?

Implement tool-level authorization by combining per-user authentication context with conditional tool filtering, either through middleware that strips unauthorized tools from the agent's toolset or through in-tool runtime checks that validate user permissions before execution.

Implementing tool-level authorization in LangChain/LangGraph involves two complementary strategies: you can either filter the toolset available to the agent at invocation time (so the agent never sees tools the user is not allowed to use), or you can pass user context into the tools and let each tool validate permissions at runtime. The recommended approach combines both: use context filtering to reduce the agent's decision space, and add in-tool authorization checks as a second line of defense to ensure security even if the agent attempts an unauthorized call.

The foundation of per-user authorization is passing user identity and permissions into your tools. LangChain provides the RunnableConfig object, which flows through the entire execution chain. You can attach user information to config.configurable and access it inside any tool function.

Configuring and Accessing User Context in Tools

This pattern ensures that every tool call carries the user's identity. The tool itself checks the user's role or permissions before executing sensitive operations, returning an error message if the user is unauthorized. The LLM can then interpret this error and respond appropriately to the user.

For better efficiency and to prevent the agent from even attempting to use restricted tools, you can filter the toolset dynamically when building your agent. This approach reduces the agent's decision space and prevents wasted LLM calls on tools that would be denied anyway.

Dynamic Tool Filtering Based on User Role

For LangGraph applications deployed on LangSmith, you can implement fine-grained resource authorization using the @auth.on decorator. This allows you to control access to specific resources like threads and assistants, scoping operations to the authenticated user.

LangGraph Resource Authorization

Here's how a complete production flow integrates authentication and tool-level authorization, drawing from the Auth0 Zoo AI example. The pattern combines user authentication (via OAuth2) with per-tool permission checks.

Complete Zoo AI Authorization Example
Authorization Strategies Summary
  1. 1

    In-Tool Checks: Most direct method—each tool inspects user role/permissions via RunnableConfig. Returns error messages for unauthorized users.

  2. 2

    Pre-Filtering: Restrict toolset when creating the agent. Prevents agent from even seeing restricted tools. Most efficient.

  3. 3

    LangGraph Resource Auth: Use @auth.on handlers for thread and store-level authorization. Best for multi-tenant apps.

  4. 4

    OAuth 2.0 Delegation: Use Auth Code Flow + OBO Token Flow for agent actions on behalf of users. Essential for third-party APIs.

  5. 5

    Fine-Grained Authorization (FGA): For complex permission relationships, consider OpenFGA/Auth0 FGA to model user-document relationships.

The recommended production pattern combines pre-filtering for efficiency and in-tool checks for security. Always assume the agent might attempt to call a restricted tool—never rely solely on pre-filtering as your only authorization mechanism, since the agent's behavior is non-deterministic and could theoretically attempt to reference a tool even if it's not provided.