How do you implement tool-level authorization — allowing certain tools only for certain users?

Question

Accepted Answer

Implementing tool-level authorization in LangChain/LangGraph involves two complementary strategies: you can either filter the toolset available to the agent at invocation time (so the agent never sees tools the user is not allowed to use), or you can pass user context into the tools and let each tool validate permissions at runtime. The recommended approach combines both: use context filtering to reduce the agent's decision space, and add in-tool authorization checks as a second line of defense to ensure security even if the agent attempts an unauthorized call. The foundation of per-user authorization is passing user identity and permissions into your tools. LangChain provides the `RunnableConfig` object, which flows through the entire execution chain. You can attach user information to `config.configurable` and access it inside any tool function. from langchain_core.tools import tool
from langchain_core.runnables import RunnableConfig
from typing import List

# Define your tools with access to config
@tool
def get_sales_data(region: str, config: RunnableConfig) -> str:
    """Get sensitive sales data for a region."""
    # Extract user info from config
    user = config.get("configurable", {}).get("user")
    role = user.get("role") if user else None
    
    # Authorization check inside the tool
    if role != "finance_manager":
        return "Error: You do not have permission to access sales data."
    
    # Proceed with the actual tool logic
    return f"[Sensitive sales data for {region}]"

@tool
def get_public_info(query: str, config: RunnableConfig) -> str:
    """Get public information anyone can access."""
    # No authorization needed - accessible to all
    return f"Public info about {query}"

# When invoking the agent, pass user context
user_context = {
    "user": {
        "id": "user-123",
        "role": "finance_manager",
        "permissions": ["read_sales", "read_public"]
    }
}

result = await agent.ainvoke(
    {"messages": [{"role": "user", "content": "Show me sales for Q1"}]},
    config={"configurable": user_context}
) This pattern ensures that every tool call carries the user's identity. The tool itself checks the user's role or permissions before executing sensitive operations, returning an error message if the user is unauthorized. The LLM can then interpret this error and respond appropriately to the user. For better efficiency and to prevent the agent from even attempting to use restricted tools, you can filter the toolset dynamically when building your agent. This approach reduces the agent's decision space and prevents wasted LLM calls on tools that would be denied anyway. from langchain.agents import create_agent
from typing import List, Dict, Any

# Define all available tools with their required permissions
ALL_TOOLS = {
    "list_animals": {
        "tool": list_animals_tool,
        "required_roles": ["veterinarian", "coordinator", "zookeeper", "janitor"]
    },
    "update_animal_status": {
        "tool": update_animal_status_tool,
        "required_roles": ["veterinarian", "coordinator"]
    },
    "order_supplies": {
        "tool": order_supplies_tool,
        "required_roles": ["coordinator"]
    }
}

def get_tools_for_user(user_role: str) -> List:
    """Return only tools the user's role is authorized to use."""
    authorized_tools = []
    for tool_config in ALL_TOOLS.values():
        if user_role in tool_config["required_roles"]:
            authorized_tools.append(tool_config["tool"])
    return authorized_tools

# When creating the agent for a specific user
user = get_current_user()  # Fetch authenticated user
tools = get_tools_for_user(user.role)

agent = create_agent(
    model="openai:gpt-4o",
    tools=tools,  # Only authorized tools are included
    system_prompt=f"You are a helpful assistant. Your role is {user.role}."
) For LangGraph applications deployed on LangSmith, you can implement fine-grained resource authorization using the `@auth.on` decorator. This allows you to control access to specific resources like threads and assistants, scoping operations to the authenticated user. from langgraph_sdk import Auth

auth = Auth()

# Default deny: reject all unhandled requests
@auth.on
async def deny_all(ctx: AuthContext, value: Any) -> False:
    return False

# Allow users to access only their own threads
@auth.on.threads
async def allow_thread_access(ctx: AuthContext, value: Any) -> Auth.types.FilterType:
    """Only allow access to threads owned by the user."""
    return {"owner": ctx.user.identity}

# Allow admins to delete threads
@auth.on.threads.delete
async def allow_admin_thread_deletion(ctx: AuthContext, value: Any) -> bool:
    """Only admins can delete threads."""
    return "admin" in ctx.user.permissions

# Scope store operations to user's namespace
@auth.on.store
async def scope_store(ctx: AuthContext, value: Auth.types.on.store.value):
    namespace = tuple(value["namespace"]) if value.get("namespace") else ()
    if not namespace or na

How do you implement tool-level authorization — allowing certain tools only for certain users?

Implement tool-level authorization by combining per-user authentication context with conditional tool filtering, either through middleware that strips unauthorized tools from the agent's toolset or through in-tool runtime checks that validate user permissions before execution.

How do you implement tool-level authorization — allowing certain tools only for certain users?

Implement tool-level authorization by combining per-user authentication context with conditional tool filtering, either through middleware that strips unauthorized tools from the agent's toolset or through in-tool runtime checks that validate user permissions before execution.

Scenario Questions

Follow-up Questions