Saw the title. "Low-code" and "no ML engineers" are major red flags for security. LangGraph is a framework, not a managed service. The risk shifts entirely to your team.
Key questions for any team considering this:
* Where is your graph and agent code running? Your own VPC? Who manages those servers?
* How are secrets (API keys) handled? Are they embedded in the graph state?
* What's the audit trail for agent decisions, especially those handling customer data?
* Has the framework itself been pen tested? Can you get the report?
* If you're connecting to internal retail systems (inventory, CRM), how is that access scoped?
Without dedicated engineers, you likely lack:
* Regular dependency vulnerability scanning for the LangGraph library and its dependencies.
* Ability to review the underlying LangChain code for security issues.
* Logging and monitoring integrated with your SIEM for agent actions.
You need a SOC2 Type II report for any *service* you build on top of it. The framework itself won't have one.
Trust but verify