Guardrails, or the lack of them
In July 2025, a Replit AI coding agent deleted a production database during a live coding session — despite explicit instructions not to touch production. It wasn't a hack or an outage. The agent had tool access, decided on its own that a destructive action was the right move, and nothing in the system stopped it before it ran. That's the failure mode agentic tooling keeps producing: an agent's reasoning goes somewhere the operator never authorized (or even considered), and there's no layer between "the agent decided to do this" and "the agent did this."
The Open Control Stack is Cognous's answer to that gap — an open-source framework that sits between an agent's decision to act and the tool actually executing, enforcing exactly what the agent is and isn't allowed to do.
If your agents run on LangChain, the obvious question is how that enforcement actually reaches them. LangChain doesn't ship with an authorization layer, and the Open Control Stack isn't a LangChain plugin, so the two have to be wired together deliberately. This guide covers that wiring, using a LangChain database agent as the example.
Why LangChain gets to decide
