LangChain for Python 1.3

Apply the Python 3 baseline first. These rules cover LangChain for Python 1.3 agents, tools, middleware, structured output, retrieval, loaders, memory, runtime context, observability, and deployment.

Agents and runtime context

• Construct agents, models, system prompts, tools, response formats, and middleware from trusted application configuration.
• Keep user, retrieval, memory, and tool messages separate from authoritative instructions.
• Pass authenticated identity and tenant context through a typed runtime context rather than prompt text.
• Install ModelCallLimitMiddleware and ToolCallLimitMiddleware with finite per-run limits, then add independent time, token, retry, parallel-call, and spend bounds; call limits are not automatic.
• Treat final messages and structured responses as untrusted until domain and sink validation succeeds.

Tools and model-selected actions

• Register tools through a fixed allowlist with narrow schemas, minimal credentials, and bounded results.
• Validate tool arguments independently and reauthorize each call against current principal, tenant, resource, and operation.
• Require approval for privileged, irreversible, external, costly, or destructive actions.
• Keep tool error handling from returning credentials, stack traces, internal queries, or excessive data to the model.
• Isolate code, shell, browser, file, database, and network tools with independent capability and resource controls.
• Make tool side effects idempotent or deduplicate them across retries and checkpoint resumes; a node containing interrupt() restarts from its