Talking Drupal #576 - Inside & Outside Drupal AI

[00:00:00] John: This is Talking Drupal, a weekly chat about web design and development from a group of people with one thing in common. We love Drupal. This is episode 576, Inside and Outside Drupal AI. On today's show, we're talking about AI, Drupal, and what's new with our guests, Dr. Christophe Breidert and Scott Falconer.

We'll also cover Drupal AI Demo as our module of the week Welcome to Talking Drupal. Our guests today are Dr. Christoph Breidart and Scott Falconer. Christoph is the co-founder of 1X Internet and product lead of the Drupal AI Initiative. With over 20 years in digital transformation and open source software development, he brings comprehensive end-to-end expertise to projects of all sizes, guiding organizations through every stage of their digital strategy and execution.

Christoph, thanks for joining us again. Welcome.

[00:01:06] Christoph: Hello. Nice to have you.

[00:01:10] John: Scott Falconer helps humans and machines think together. He leads Applied AI at Acquia, serves on the Drupal AI Initiative leadership team, and authored Managing AI. Drawing on a background in cognitive science and enterprise-scale architecture, Scott focuses on his messy, practical mechanics of integrating AI directly into everyday workflows.

Scott, welcome back, and thanks for joining us.

[00:01:37] Scott: Yeah, glad to be here.

[00:01:39] John: I'm John Picozzi, solutions architect at EPAM, and today my co-host is, uh, Nic Laflin, founder at nLightened Development. What's going on, Nic?

[00:01:48] Nic: Not too much. Happy to be here.

[00:01:50] John: We're talking about your favorite topic today.

[00:01:53] Nic: Drupal?

[00:01:53] John: Yes. I can't...

Uh, Dru- ah, well played, sir. Well played. All righty. And as we do, let's turn it over to Martin Anderson-Clutz, a product marketing manager for Drupal at Acquia and a maintainer of a number of Drupal modules of his own, to talk about our module, question mark, of the week. What do you have for us this week, Martin?

[00:02:16] Martin: Thanks, John. Have you ever wanted to try out all of Drupal's AI features on a realistic site and then pop the hood to see exactly how they're configured? Boy,

[00:02:25] John: have I.

[00:02:26] Martin: There's a demo for that. It's actually called the Drupal AI Demo, and the project was created on October 4th by Christophe Breidaert, a Drupal AI product lead, with support from 1X Internet, Freely Give, and Foster Interactive.

The demo itself was revealed in the Dreese note at DrupalCon Rotterdam. The demo runs on Drupal CMS with the Drupal AI modules running on Drupal 11.4. Looks to be actively maintained, and the project has a README that is really clear about what you can try and who has access to what. The project has 83 open issues, 2 of which are bugs, and the demo is really a site for Northmore University, a fictional coastal university with realistic programs, news, events, people, and images.

You launch your own copy for free through Drupal Forge. No install, no config, no credit card, and AI credits are included courtesy of Amazee AI. Each demo instance lasts 30 days. Features include AI search with cited answers, page generation in Canvas, content review, auto-classification, translation, image validation, image generation and alt text, AI disclosure labels, observability, and an MCP server so tools like Claude can work with the site's content.

Each s- feature has a step-by-step explainer page in an AI features section right in the demo site. The best part is you have full admin access, so every agent, prompt, index, and view is right there to inspect, tweak, or rebuild on your own site. Lots of the features are public recipes you can use today, like AI answers, AI image alt text, AI content classification, and AI SEO optimizer.

The big caveat, the AI demo project is really a placeholder. It's the README plus the issue queue. The actual build, content, theme, demo-specific recipes, and deployment, uh, all of that lives in a private GitLab repo for Drupal AI partners. So the project's real job is feedback, issue templates for bugs, feature requests, feature page fixes and plans, each tagged by demo component.

Fixes show up the next time you launch a new copy. The build was a big community effort from August to late September, more than 100 contributions, 1,442 commits across 54 projects, and 16-- 616 merged MRs, adding roughly 596,000 lines of code. Now, back in episode 529, we covered the AI ecosystem recipe, and both are about getting the Drupal AI stack in front of you fast.

The difference is the mechanism. The recipe adds the AI modules to your own site for you to configure, while the demo is a fully baked hosted instance with content and prompts already tuned so you can not only try out, but also reverse engineer a working setup. So let's talk about the Drupal AI demo

[00:05:22] John: Oh boy.

So I'm, I was kind of excited when you brought this up because, um, was it last week? Maybe it was last week. I was reading, uh, the Weekly Drop newsletter, and I noticed something in there that said, "Hey, you can try Drupal. He- try the Drupal AI demo." And I was like, "Huh, okay. All right, guys, I'll bite. Let's try it out."

Like, you know, a little skeptical, admittedly. Um, went to the page, you know, and, you know, clicked a couple buttons, did the thing, and all of a sudden I was in the, uh, in the, the, the fake college site, and I was like, "Huh." I'm like, "You know what? I'm gonna try to build a new course page." So I opened up Canvas AI, and I was like, "Hey, build me a course page about this course, and on this thing, and do, do, do, do, do."

And it came back and said, "Yeah, I'd be happy to do that. Here are a couple more questions I have, like how long is the course? Are there any prerequisites? Are there da, da, da?" And I'm like, "Yes. No. No. Yes. No." And then sure enough, hit, hit enter, and it went out, and it built me a course page. Now, was the course page like 100% the most beautiful thing in the world?

No, but that's because I literally gave it this much information. For those of you listening, I'm showing a very small amount of space between my fingers. Um, uh, uh, so it didn't really have much to go on, but it literally got me, eh, I'll say, close to 75% of the way there in building a page where I could go in, tweak a couple things, you know, provide more, uh, provide better visuals maybe, and a, and a, you know, a, you know, some updated text, and like I could have published that to my website.

So super excited to talk about this. I think, like, if you're listening to this podcast, pause it right now and go play with this thing, and then come on back. Um, if you're here live with us, stay here live, and then after the show, go, go play with the, play with the demo. I think it's super cool.

[00:07:15] Nic: I'll, I'll say too that the, the demo is different than the demo video on the page, so make sure you go to Drupal Forge.

Um, I, I think one correction, the demo, I don't think the instances last 30 days. I think it's just one day. Um, but you can spin up as many if you don't finish, which you probably won't because there's- No, you can, you

[00:07:32] Christoph: can extend the demo, and it extends- Oh ... up to 30 days. So it closes- Oh ... after an hour or something like this, I think, and then if you then don't interact with it anymore, it just shuts down.

[00:07:42] Nic: Ah, okay.

[00:07:43] John: If you're, if you're like me, and like you literally play with it for 20 minutes, and then you're like, "Okay, I'm done."

[00:07:47] Nic: Yeah. Which, which makes-

[00:07:48] John: You know ...

[00:07:48] Nic: which makes sense.

[00:07:49] John: Leaving that thing hanging around for 30 days feels expensive.

[00:07:52] Nic: Yeah. Yeah. That, that makes sense. I, a- and to, to Drupal Forge's credit, and I'll have some questions about this, like it's very fast to spin up a new instance.

Um, I spent... The, the... I forget exactly how many were there. Maybe 12 or 15 fully fledged out different workflows. The one that I interacted with the most was the content moderation. Um, and I would say that, you know, being able to kind of test, uh, the, it, it handles, um- Not just like Inappropriate content moderation, but also, like, is this correct for where you're commenting type of moderation.

So- What,

[00:08:31] John: what's your favorite, uh, inappropriate content moderation test? Just, just wondering.

[00:08:36] Nic: Yeah. So, so- Yeah ... uh, so for example, like, there, uh, the, the examples on the site, there's a selling board, and then there's a course discussion board, right? So if you try selling something, something on the course discussion board, which is, you know, inappropriate, you know, it's not swears, it's not an insult, that kind of thing, it won't...

It'll put it into a moderation queue for a human to look at to confirm. But if you insult somebody, it will block it. I will say the w- the one thing that I found, I mean, uh, painful is too strong of a word. The one thing that I found, um, it would be nice to solve is it, because it's going out and getting feedback from an e- from a, a service, saving a comment takes significantly longer, right?

It takes, um... The, the bonus is that if it's a fine, if the comment is fine, it gets posted immediately. But the feed from when you hit save until it shows up- Oh ... where it gets bounced back is, you know, seven to 10 seconds, which, I mean, you get a spinning bubble, but that, that's kind of long. It'd be good if you

[00:09:38] John: could just like- I see.

So you're, you're saying comment goes out for moderation in real time and, and then based on where- Yeah ... it needs to go, it either posts it or it says, "Hey, your comment will show up in, as soon as somebody reviews it."

[00:09:48] Nic: Yeah. Yeah, yeah. And, and there's ways to queue things like that. So I think it makes sense for the demo to do it this way.

So you're seeing the feedback immediately, but the AI module lets you queue things and do it on a cron or something else. Mm. So you could have it save immediately, have it go through mo- moderation and they get published if it's not. So, so there's ways to solve that and probably the demo is not the place to do that anyway.

Um, so

[00:10:09] Christoph: but- What's nice about this particular piece of functionality, like if you just test around more, so you can actually say like, "I don't like this professor because she is bad at teaching." Yeah. And, um, that will go through. But if you say, "She's a bad teacher," that will not go through because that's then like kind of a fact about a person that you're just stating without any claim, but you can have an opinion on it.

So if you just check out how the, the Gentech functionality is built in the background-

[00:10:34] John: Mm ...

[00:10:34] Christoph: you actually see all these l- nice little nuances that, you know, that are not so easy to configure if you don't know exactly what you're doing. And I think that's the beauty like, of the functionality and the demo that you can actually go in and you can just look how is this set up and like- Yeah

how can I tweak this to fulfill my needs.

[00:10:49] John: Yeah. You guys are, you guys are reminding me of that, that service from back in the day, Rate My Professor.

[00:10:55] Nic: Yeah. I mean, that- I, like- ... all, all those thing, things exist and they're all-

[00:10:58] John: Yeah, I'm like- They're

[00:10:59] Nic: all cap- they're all captured services at this point. So they're pretty useless.

[00:11:03] Christoph: But- But speaking about inappropriate content, have you tried the other functionality with image uploads?

[00:11:07] Nic: No, I, I didn't get there. But I, I do, I do wanna say- Interesting ... I did try, I did try getting the distinction between criticism of a person and criticism of a quality of a person, and I w- I wasn't able to like, uh, on the s- the example selling page is somebody selling a wetsuit, I think And I tried posting multiple versions of like, "Hey, that person doesn't actually have a wetsuit, they're lying."

And no matter what I did, I couldn't get it to post or even moderate that comment. It just said, "Hey, you're insulting her." It's like, "Wait, no I'm not. She doesn't have a wetsuit to sell." So, um,

[00:11:40] Christoph: but- So if you haven't tried, if you haven't tried like inappropriate images, that's like a really fun feature. And, uh, the demo actually ships inappropriate demo images.

So you will see like two generated images of a group of people, in one they're just smiling, in the other one they're smiling and like mo- showing some signs. Yeah. If you download that, uh, example image, you try to upload it again, it will just get flagged. Yeah. And there's a couple of more of those in there and, um, and you wouldn't even see it.

If you just scroll over the page, yeah, you wouldn't see that just one person in a group of people is just, you know, like showing the middle finger, and you would just totally overlook it, but AI spots it. And, um, and I think that's also like a really good example of if you just have content that is just uploaded by people, you know what I mean?

There's no way that you can just automatically, uh, that you manually can just spot such things.

[00:12:27] Nic: Yeah. And, and there are others. There's services you can use for that kind of thing too. So I, I think the, um, i- the ease of integration, I think is a selling point for this particular one, 'cause yeah, I mean, that the, the content moderation is hard for small teams, but using AI, I think you can achieve that I think honestly if I was working on a site that allowed public, you know, the public to upload images, I probably wouldn't use AI moderation.

I'd probably use one of those services because you want the actual, um, liability coverage, right, if something gets through. Um, so there's still s- you know, there's still reasons to use service providers for things, 'cause you can-

[00:13:08] Christoph: Yeah, but still, I mean, we operate many large websites with many editors, and they just upload images, like, and then, I mean, if you're just- That's true

writing a blog post about, like, some, some company event, yeah, and then you have hundreds of photos to choose from, I mean, you're not going to spot that, like, and this photo is something that is not allowed to go in. And if, like, you know, your content management system flags this correctly and says, "Achtung," yeah, be careful with this photo.

I mean, that's just a huge plus.

[00:13:33] John: Yeah. Yeah. And I, I can see that- Yeah ... in an, in an area of, like, especially education, where, like, you have content editors just adding content and, like, you know, y- they're supposed to be responsible for the stuff they're posting, but you know, things, things slip through the cracks.

Yeah, I can see that definitely being useful. What were you gonna say, Martin?

[00:13:50] Martin: Oh, I was just gonna say, I mean, a perfect example is actually on this show a few weeks back. We had a guest on, and, uh, his image on the poster had a square on his T-shirt, right? So that's, to Christoph's point, the kind of thing that it might be easy to, to miss when you're looking at just a thumbnail.

Mm. You know, get that put onto a page, and then oh, now we, we've actually got something inappropriate on the website. So AI could be good for catching those kinds of things.

[00:14:13] John: Uh, yeah. Sure could. Um, I love the d- I love the demo. I think everybody should go try it out, ki- kick the tires on it. I think it's a great, uh, great example of, of the, the AI powers that, that Drupal contains.

Yeah. And it allows you to kinda do some pretty interesting stuff with it too.

[00:14:32] Nic: So. Yeah, but before we close out, I did wanna know, what, what was it like working with Drupal Forge, getting that set up?

[00:14:41] Christoph: Um, I mean, like, uh, y- I can answer this one on multiple levels. So, um, the person who we are working with directly is, is Darren O.,

really nice person. Yeah. And he's responsible on Drupal Forge side for everything related to Drupal and Drupal demos. Um, uh, so Sal, who is, uh, his colleague, is working more on, on, on dev panel. He was in the background, also very nice person. And, um, and, um, they're really collaborative. Like, in the, in the, um, uh, crunch time right before DrupalCon, like, Darren was with us.

We actually said, that's actually, uh, now that I remember, like, the day before the DriesNote, because in the DriesNote, um, the demo was revealed, like, something wasn't working, so it was a real go live. We sat there, like, in a call, like, Marcus, myself, Darren, and, uh, and Artem. Yeah. And, uh, and, and actually I was s- I was supposed to hang out with Scott, like, in the hotel bar, and he was waiting for me at the hotel bar, but I couldn't join for a drink because, like, we had to get the freaking demo live.

[00:15:37] Scott: Well, he's not, he's not mention- Yeah ... he was in the bar at the time. So I'm on one side of the bar hanging out.

[00:15:41] Christoph: Yeah.

[00:15:42] Scott: He's on the other side of the bar on his laptop working, so. Oh. I can,

[00:15:45] Christoph: I can vouch for Stephen that. He's like, "I'm

[00:15:48] John: on a call."

[00:15:50] Scott: Yeah.

[00:15:50] Christoph: Yeah.

[00:15:50] Scott: He was just copying and pasting from Claude and putting it in, not really.

[00:15:53] Christoph: Yeah, well. I was doing the least. I was just observing because, like, I mean, like, the other people did the heavy lifting. I was just helping. And, um, but they just, I mean, they really put everything on the line to just make that happen, and, uh, y- you see it now. When you click on the demo, it just spins up in literally no time.

Yeah. And, um, and it just works. You know, I, you know, I, it just works, you know? It's just really cool.

[00:16:18] John: Yeah, for sure Yeah, I'll

[00:16:18] Martin: say I've worked with, uh, with the Drupal Forge guys a couple of times too in terms of getting demo environments created for both event platform and, and more recently the Summit site template.

And I'll echo everything Christophe said in terms of, you know, they're just super great to work with, very helpful, you know, um, yeah, very collaborative, so.

[00:16:40] John: Very cool. Yeah. Uh, if you're listening, I recommend you check out the demo and, uh, you know, file, file a ticket if you find a problem or, uh, if you have a really interesting use case.

Uh, I'm sure there's a, a Slack channel you can drop it into and, uh, tell everybody how, uh, you were able to achieve it. Uh, well, Martin, as always, thank you for finding a, um, perfect not so much module, but Module of the Week. Uh, if folks wanted to suggest a, a module or a demo or, uh, really anything, uh, how could they best go about doing that?

[00:17:16] Martin: We're always happy to have conversations about candidates for Module of the Week in the Talking Drupal channel of Drupal Slack, or folks can reach out to me directly as mandclu on a variety of Drupal and social channels. And also in the coming weeks, I will be at some events where folks can catch up with me in person.

So look for me at, uh, NedCamp, at the Evolve Digital in New York City, and then later on at the Paris AI Summit.

[00:17:42] John: We are gonna see a lot of each other in November, huh?

[00:17:46] Martin: Sounds like we are.

[00:17:47] John: I look forward to it. All right, Martin, thank you so much.

[00:17:51] Nic: Awesome.

[00:17:52] Martin: Thank you. See you soon.

[00:17:53] John: Yeah, have a good one.

[00:17:54] Martin: You too.

[00:17:56] John: All right, so Drupal started out, we had an AI initiative, uh, and then, um, I don't know, it feels like maybe a couple of months ago, maybe it was longer, maybe I'm, I'm misquoting here, um, we decided to split it into inside AI and outside AI. I'm wondering, um, Scott, if you can kinda give us an overview as to, um, why that change was, was made and, and maybe a high-level overview of what the two work streams kinda work on.

[00:18:29] Scott: Yeah. Um, let me define kinda what they are first, and then we can talk about- Sure ... why we did it. And in simplest form, I just think of it as the user that is using Drupal directly. So inside AI is a human that is looking at Drupal and using Drupal directly. There may be agents inside Drupal that are doing things for you, so like the content, uh, moderation.

You upload an image, and the agent takes off. Outside AI is you are telling an agent to do something, and then it is using Drupal to perform a task. And so- Mm ... this is where we saw a split. And this, a lot of it comes down from just different personas and how they work. The outside AI is much more how I work personally and within the kind of stuff we do at Acquia.

[00:19:13] John: Mm-hmm.

[00:19:14] Scott: Where Christophe is much more working with, you know, people that need to use a CMS and use it- Mm ... directly and want the AI functionality and features in that.

[00:19:22] John: Okay. So let me, l- let me see if I, if I understand this. I think I do. But, like, inside AI is like I log into Drupal, and I have AI agents inside my Drupal site that create content or go, go post something to a social network, or they, they work inside of the CMS to, like, produce, produce content and do things.

Outside AI is I log into Claude on my computer, and I'm like, "Hey, uh, I need you to, you know, go hit up my Drupal M- MPC, M- MCP, MCP server, and, like, go do this thing." Is that-

[00:19:56] Scott: Correct. Exactly ... fair? Yep.

[00:19:57] John: Yeah,

[00:19:58] Scott: yeah. Okay. Yeah. Uh, and that's probably the cleanest definition. And in reality, there's nothing clean about it because you end up doing both.

Um, you know, there's things like- If you're testing like a Claude voice demo, you're gonna be using Drupal in likely four interfaces at once without ever realizing it. Mm. Like, so you'll be talking to Claude, Claude is connected to Drupal via MCP.

[00:20:18] John: Mm-hmm.

[00:20:18] Scott: Now, if you wanna upload an image, Claude is likely gonna pull up a form or show the HTML on the page.

[00:20:24] John: Mm-hmm.

[00:20:25] Scott: Now you're looking at Drupal doing some inside stuff. Within that page, there very well may be web MCP tags, which again is more of the outside. Mm-hmm. And then through all that, I tend to have a screen up with it. So it blends back and forth. Mm-hmm. And part of the goal is while there are different areas of focus and stakeholders, like it's not an either/or.

They are very much dependent on each other, um, and working together.

[00:20:48] John: But, but on the outside side of things, right, like somebody might not know that they're necessarily interacting with Drupal, right? So like if I'm, you know, somebody using Claude and I'm like, "Hey, go find me information about, you know, the three top content management systems and then, you know, I don't know, provide something back to me", they may go out and interact with a Drupal site that may say, "Oh, here's all this information that you need," or, "Here's a, here's a service that you can, you can use to like, uh, you know, assist this person in their answer."

And they might not even necessarily know they're interacting with Drupal. Is that, is that fair to say?

[00:21:25] Scott: Ex- ex- exactly, yeah. And, and I think that's a very common pattern, and it's a really important concept for the growth of Drupal. If you think about most of the people in the world that use Drupal from just a use it side- Mm

they probably don't even call it Drupal, they call it the site. Yeah, yeah. Their company, they have a site. Yeah. And so we, we show this in the Drice Note demo where the content editor says, "I want to..." or, "I have found a mismatch between the pricing on our judge translations versus- Mm ... the English pages.

Change that for me." Yeah. Those very well could have been pages made in a traditional way. The content editor there doesn't know Drupal, right? Right. And when we show that demo, the person making that change, it is, if we added it up, I think it's 40 actions across 20 pages to actually do it manually- Mm ... in Drupal.

That is a steep learning curve for somebody who just wants to change the price on a specific translation.

[00:22:16] John: Yep.

[00:22:16] Scott: Like we all- 100% ... everyone listening here knows what I mean when I say revert the revision on this specific language.

[00:22:21] John: Yeah.

[00:22:22] Scott: If you're just trying to do your job, like that's too much, and so that's where it kind of comes in.

[00:22:26] John: Got it. So Christophe, let me ask you the kinda second part of my question, which is like we had an AI initiative, and then we kind of broke it into two distinct work streams. Like why was that change necessary?

[00:22:42] Christoph: Um, I think it was just a natural evolution.

[00:22:45] John: Mm-hmm.

[00:22:45] Christoph: I mean, I think the examples we've touched, like here in, uh, in, in our conversation right now, they're pretty good.

I, I think for most, I mean, we built a lot of websites for, um, for large, uh, organizations here with many editors. Yeah. And, and at the moment, I mean, the content's built somewhere, maybe Google Doc or something, and then at some point they log into Drupal and then they use the UIs the agency has provided to just like, you know, copy paste the content in.

And that's of course like, uh, that's, that's boring and that's time-consuming and like if you don't have many content types or whatever, it can also be difficult. Yeah. And um, and the main thing that, uh, the main improvement I think for these workflows will be that you can just, you know, you can work on your content in your Google Doc and then you can just point Claude or ChatGPT or Gemini or whatever you have.

You can point and say like, "Look here, take this document and then just, you know, put it into my website and use this template." And it will then- Yeah ... do these steps for you. Like at best it would just, you know, do this through a controlled interface such as, uh, MCP. It would log in as you, so it's effectively you doing it on, on the page with like e- the exact same permissions that you have if you logged in through the UI.

Yeah. And, um, and, and, and that just makes sense. So therefore, for this particular aspect, that's just a natural evolution of just like allowing, uh, Drupal to be controlled from the outside while what we have on the inside stays completely unchanged. Because like part of uploading this content was that maybe the content is not following, um, you know, tone and voice guidelines, or maybe there's some legal risk in the text because something is ambiguous, or maybe the imagery that's being uploaded has like some of these little flaws that we dis- discussed earlier.

So that is just AI functionality that lives inside of, of Drupal, which, whose job it is to discover the content in a good way. And, um, so, and that's the perfect example of like what AI inside of Drupal does. And, and I, and I think like to just, you know- You know, focus on these both sep- they're just distinct things that are both important, but they both work hand in hand.

So therefore, like, you know, dividing the work between Scott and myself, um, we're just leading, like inside and, and outside just makes a lot of sense. I mean, we do a lot of the same things, and we align on mostly everything, but like the angle is just, it's, it's just from a different point of view, so to speak.

[00:25:00] Nic: Y- you also just made me think of something too that Drupal does that I, I think will become more important as we move forward. So Drupal now has the access policy. Uh, 'cause you mentioned that when you're using the inside Drupal, it's using your account essentially. It's almost like masquerading like you.

But really, I think many times you want a subset of your permissions, and access policies seems like a way to do that. Like if you're logged in as me, but you're an agent, then maybe you don't have delete permission, even though I do have delete permission. Or maybe, maybe you don't have the permission to publish something, you can only put it in moderation, whereas I can bypass moderation.

You can always achieve that with a separate account and a separate role, separate role. But if you can use the built-in access policy rules to like say, "Hey, in this context, some of these things..." Or maybe, maybe it's just that, um, if it's in that context, it has, you get a confirmation message for it, so they can't just delete it.

You have to, you get an actual like confirmation. Whereas if you're deleting it yourself, you don't.

[00:26:04] John: What's the, I mean, what's the, what's the thinking there, Nic? Because I'm like, in my head, I'm like, oh, I just create like a service account for the AI to use, right? Because I'd want it, I'd want it to kind of have its own Like account and, and maybe an email that comes back to me that's like, you know, John plus AI, right?

[00:26:24] Scott: Yeah, here's the thinking on it, 'cause this is the question is probably one of the most important things we have ahead of us for Drupal. Um, and yeah, there's two ways to handle it. Like at its basic, like take a step away from Drupal. This is just the whole OAuth scope stuff. The world at large already does this every day.

You know, my parents come in and they connect up to their Gmail and it says, "Do you want Gmail to be able to read or read and write?" Or, "It's only going to be able to read." Those are scoped permissions, and that works for the majority of the world, right? And this idea that, you know, people choose a content management system for a reason.

They have some sort of complexity and a hard problem to solve around content and rules and process, and they want it enforced. It's not good enough just to ask the agent nicely, "Hey, please behave." We know how that's gonna go. No different than it is the same to ask users. It's, it's, it's the same user-generated content problem of like, "Please don't do that."

Well, you have to have some sort of enforcement on it. There's a lot of interesting stuff that has come out of Cloudflare in this space, where you can't make it too cumbersome for people to connect an agent because once you do, they're just gonna give the agent control of the browser or the desktop, and then you have no way to track any of this.

So part of this is what's coming out of the, the agent access module ecosystem, which is basically the existing simple OAuth, MCP, and the tool API. And, and we'll talk about this in a minute around the Rosetta and where people can get involved, the Rosetta, uh, sprint. But it is exactly this case, like we should make it very easy for a user to connect to a Drupal site as themselves, where they are delegating to an agent.

So we at least have the option in the logs to say, "This was Christophe done via ChatGPT," right? Otherwise, we lose that information. Christophe should have a way to clearly say This is everything I can do as myself, so that's the ceiling. Drupal's gonna enforce it. Neither Christophe or the agent can do more than what he has permissions to do, but Christophe can down scope what's possible there.

Like, I, on Drupal.org I've, I've had a hard time with this where no matter how much I tell the agent not to, every once in a while it'll post a text for a merge comment, right? So, like, this stuff happens, and it's either just, like, do you not give it write access for some things that you want? And so the scoping of permissions and getting very, um, granular, and that's where Drupal has a huge strength because we do have this role-based access control and granular permissions that a lot of other things have that we can get down to, like, the specifics of a field, and it's really powerful.

But there's a hard, uh, user experience. So this is a call out to anyone in the user experience space. Would love to have your input on this, 'cause it's a tricky, tricky one to do right that's not gonna just cause users to zone out.

[00:29:10] John: So sorry, I might, I may have missed this, but I think what, you know, what I heard you say there, or the way I interpreted what you just said, was that you would say, like, a separate, a separate Drupal user account for your AI is a good idea?

Nope. Even though it's- Nope. No. Absolutely

[00:29:24] Scott: not. Nope.

[00:29:24] John: The opposite. Okay.

[00:29:26] Scott: The opposite.

[00:29:27] John: All right.

[00:29:27] Nic: A, a, your user account with the context of the agent so that you can, you can know who, whose agent it was, and you can also give finer grain controls to that agent so they have less permission than you. Uh, so for example, like, uh, a, and a simple example is you probably never want your...

Well, maybe you do. I don't know. I, I, I would think most people wouldn't want their agent updating the email address or maybe their password, right? 'Cause if I'm changing my password on a site, I want it to be in the password manager.

[00:29:58] John: Yep.

[00:29:59] Nic: Um, and I sure as heck would never give access to my password manager to any of my agents, right?

Uh, uh, to, to an agent. 'Cause who knows where, where that's gonna go off. Like, that's, you know, that's like giving access to all your API keys.

[00:30:12] John: To Scott's previous example, all your passwords end up in a merge request somewhere, and then you're-

[00:30:17] Scott: Yeah,

[00:30:17] John: exactly ... then you're really in trouble.

[00:30:19] Scott: But it, it does, like, this is where, like, the what an administrator can put in.

So in that case, I give my agents a whole lot of access to a whole lot of stuff. But in a lot of systems to actually perform that final destructive thing, you have to, like, two-factor auth- authentication is really good, right? If you want to delete a repo- Mm ... or something like that. So that's being enf- enforced by the upstream, and that's really nice 'cause the agent will get up to there and say, "I couldn't go anymore.

I don't give the agent my access to my passkey or my two-factor auth, so it just can't do this." Um, but you- Yeah ... the, the separate account, there is still a need for like a service account to some extent, but if you think about how you're actually gonna work and how humans are actually gonna work, you just wanna do your job.

You don't wanna jungle- juggle a couple accounts. And in the example, like that example that we showed in the Dries now where the content editor is just trying to work, you are probably going to be working in multiple interfaces at one time, right? So you have one or more tabs open as you, you want some help doing something, you wanna bring those together.

To have to juggle those between accounts of just your personal identity is very hard. Hmm.

[00:31:24] Nic: Um, be- before we move on with the show, we have a question from Tim, uh, who was our most recent guest host. Hi, Tim. He wants to know, do you see the DA adopting either of these approaches on drupal.org? He's found kind of the drupal.org site UX a little bit hard to, to understand and use

[00:31:47] Scott: It, it depends what part.

Um, so the move to GitLab makes a lot of the outside stuff really, really easy. Like, you're just using GitLab's tooling, which is really great and really mature- Mm ... in that sense. You can do those kind of granular permissions. Um Yeah, I would say for the- I

[00:32:02] Christoph: think, I think, I think the question is about drupal.org itself.

[00:32:06] Scott: Yeah.

[00:32:06] Christoph: Yeah. Because, um, so we could improve it in two ways. We could just, you know, make it accessible from the outside, so then you wouldn't have to log into- Mm-hmm ... this, uh, old monster anymore, and you could, like, plot figure it out. Or you could clean it up and make engaging AI stuff on drupal.org inside to make the work of people publishing content there easier.

Um, uh, I don't know, like- I see- ... as far as I know, I am involved in, like, lots of discussions here, and, um, also involved a lot in, in, in, in marketing on drupal.org. And, um, so there's no clear either/or. Yeah. Um, what's going on at the moment is, um, um, um, they're reconsidering to just, like, rebuild the page completely visually, yeah, to just make it, uh, uh, to make it better.

But, like, it also has to work. It has to, you know, it has to be m- manageable in, in time, and there has to be budget for it. Yeah. So, like, it's, um, they're looking at different options at the moment. Yeah. I mean, I think you had Tiffany here on the show, um, uh, just a few days back, and, um, she's doing a sensational job of just making things happen, and she's making a lot of things happen also in this area.

But, um, there's no, no distinct route at the moment where this would go.

[00:33:23] John: Yeah. I mean, I think I, I, I look at Tim's question and it starts, starts my wheels turning of like, okay, well, first things first, we need to make sure drupal.org is upgraded to Drupal 11, right? So that way it can get- Yeah ... it can get the latest and greatest.

So that's step one, which DA's working on. We should, we should be there, I don't know, but hopefully, hopefully in the, in the next, you know, six months or so, maybe. I don't know. Um, but that, you know, that's step one. And then I think, like, my immediate brain goes to like, oh, enabling an MCP server on drupal.org, so that way you could use that outside AI to be like, "Hey, create an issue on drupal.org and here's, here's all my, uh, here's all the information."

And granted, that's probably gonna go back to GitLab a little bit too, right? Because that's, that's really now gonna be the issue system of record. But I, I think, like, building those connections and allowing, allowing for that information to kind of get outside of, of drupal.org makes a lot of sense. Um, and then as far as, you know, the i- the inside part of it, I think, you know, I think, hey, Christophe, you're right.

Like, you know, enabling some sort of AI agent when you log into your, to your Drupal account to help you do things that you would normally do when you're in there, um, makes a lot of sense. But, you know, I tend to agree, we're probably, we're probably a little far off from that.

[00:34:42] Scott: Yeah. But is

[00:34:42] Christoph: that- I think what has, what has proved not...

Oh, sorry. Go ahead.

[00:34:45] Scott: No, you, you first

[00:34:47] Christoph: Yeah. Well, what hasn't, what I was going to say, because like we, like within the AI initiative, we're coordinating so many contributors, and we are just coordinating the work on so many projects, uh, at the same time, and then all this flowing into the demo. And, uh, so what has helped us a lot is that all of this work is, is happening on, on GitLab, on Drupal's, uh, GitLab instance.

Yeah. And that is, of course, you can just connect there with like your agents. Yeah. And, um, you can do this automatic. So like when I file issues, I just like have agents, you know, like suggest them to me. I just approve and then it gets created. Yeah. And, um, I also, uh, we use agents for just like, you know, finding issues and classifying issues.

There's triage going on, on the issues. They're estimated automatically and, um, so that all works. So that's, that's a huge time saver. And here also the experience for contributors or collaborators in general is just really nice. Yeah. Just Drupal.org itself, not so much yet, but maybe as you just said, John, you know, maybe it's also becoming less important because if, if Drupal is not hosting the issues anymore and like interaction is not happening on Drupal anymore, it's happening on, on GitLab, then maybe also this, this pain point is just becoming less.

I mean, where it still does exist is in marketing because they have a hard time of, uh, creating great content.

[00:36:02] John: Mm-hmm.

[00:36:02] Christoph: But, um, I too hope that's gonna be fixed like within the next six months.

[00:36:06] Nic: I, I, I don't think this is a, uh, a tangent we need to go down, but there, there's, there's, there's still a lot of issues, at least from the core side, there's still a lot of issues with moving to GitLab, right?

There's, there's a lot of workflow and a lot of process that's lost, and so- some of that has to change, some of that has to be modified, but there's some things that just don't, don't exist. So there's, there's not feature parity yet. Um, so it's not a... And there's also some, like, I don't know if you've seen, um There's some discussion, there's been a lot of discussion about exactly that, like the triage piece, right?

I think on an individual... One of the nice things about GitLab and the, the, the move is I think individual projects can make that decision themselves if they wanna use something for triage. But for Core, it's a much stickier question on whether or not you can use an agent to do triage because, um, some people may not...

You know, there's a, there's a lot broader, there's a lot broader number of people contributing, and so there's a lot more opinions, um, and it's not as cut and dried. Um, you can see some of the fallout from the Linux project, um, who recently started adding some triage and, you know, there's, there's a lot of fallout, there's a lot of contribut- there's contributors leaving because they weren't informed about it, they weren't asked, they weren't, you know, just their stuff was started getting thrown at LLMs without their permission or even knowledge.

And so Core, Core is big enough and has enough contributors that we would face a similar, um, a similar question. So I think Core is a long way so if we ever get there, we're a long ways away from that, whether we're on GitLab or not. So there, there's still process questions that need to be resolved, I think.

Um-

[00:38:00] Scott: I, I'd also add to this too, like the, the modernization of Drupal.org, and this is where the real dark side of AI comes in. Like last week, a whole lot didn't get done for a lot of people that have anything to do with PHP, right? I know there's a lot of modernization work that can be done. I know Gabor did a lot of trying to like update the localization type stuff.

There's just a lot of parts. So that's the other part where when we talk about Outside, part of it is also using it for development and coding and tools and stuff like that. So if you're looking to try the stuff out, uh, there's, there's more than enough to do to help Drupal.org. So like reach out to the AI initiative and we can put you in touch with the right people.

But they're very busy. Everyone on the security infrastructure side, there's a lot going on that I'm sure they'd rather be working on more fun stuff at the moment.

[00:38:42] John: So Scott, you just, you just hit on something I wanna, I wanna go into a little bit, a little bit deeper. Um, earlier in the show, I kinda tried to give an example of Outside AI, which was not the best, not the best example, right?

Um, I'm wondering if you're seeing any, um, Outside AI kinda real world examples, um, in the wild where you're like, oh, you know, this group, organization, company has used, you know, MCP or has used, you know, an, an Outside service to connect to, to Drupal to do this cool AI thing.

[00:39:18] Scott: So you want Drupal specific examples where someone has used the outside tooling?

[00:39:23] Nic: Um-

[00:39:24] John: Yeah. I mean, I think, I think that would- This is still

[00:39:26] Nic: a Drupal show, yes.

[00:39:27] John: Yeah. I, you know, I, I, I, I'll ask you at some other point in time about just random, you know, outside AI use cases, but let's, let's go Drupal focused for now.

[00:39:36] Scott: N- no, no, h- h- here, here's why I, I bring it up and ask if it's Drupal specific.

Yeah. Because it is, it's a content management problem, and there's some really interesting stuff here, and I think we're in this phase right now where a lot of people are saying, "Why do I even need a content management system?"

[00:39:52] John: Mm-hmm.

[00:39:54] Scott: And it is becoming rapidly apparent why. Mm-hmm. And you're starting to see the problems caused by this gap of not having secure ways to understand what's there, what your content is, and what your information.

And, you know, I know this is not answering your question directly, but there was- That's okay ... a couple really interesting things that I'd love people to, to keep an eye on. Like, one, when you're hearing all these things about OpenAI attacking stuff, look into them closely, and half the times you're gonna find a content management problem underneath it.

So there was one a couple weeks ago, Australian healthcare, and I don't know all the specific details, but it was something like the agent swarm was blocked from getting access to this otherwise public data, so nothing private actually got leaked, but the agent was very persistent. So what it did is it found a non-production environment.

You know, that's just a classic web thing. You have production, non-production. Even then, it still couldn't get to it. But very much like a bored teenager that has a ton of time on their hands, what it realized was it could gather all the snippets from, I believe, like, the get parameters on the search and reconstruct all the data on the site, right?

So it put all the data back together. Like, it was basically just, like, searching, iterating through. The other similar one that comes to mind all the time in this is the, how the world first heard about the Mythos model from Anthropic, right? So this was the model that's too dangerous for the world to even know about at this point.

They had a content management system, and this wasn't the content management system's fault. This is just where the complexity of the problem. In that content management system, the content itself was unpublished. The assets attached to that content were still publicly available. The website that was calling that content management system did not show those, but if you hit the endpoint, you could still gather the attachment to them.

So long way of saying, like, yes, we are seeing people use this stuff, and it is pretty early, but I think the conversation that we're gonna have over the next six months is a lot of people realizing, like, "Man, we really need a content management system to get ahead of this stuff," because this stuff is just getting much wilder and harder to maintain.

And anywhere, like, we've been fortunate for a long time. Like, we can be a little laissez-faire about, "Oh, I, I know you could get to this if you wanted to put that much effort." Well, now there's this persistent little alien that will do that all day long and will get it.

[00:42:09] John: Yeah. Security by obscurity is not- Yeah

is not gonna be the, the norm or accepted at this point-

[00:42:15] Scott: Exactly ...

[00:42:15] John: on,

[00:42:16] Scott: on

[00:42:16] John: a lot of this stuff. Yeah.

[00:42:17] Scott: Um- To answer your question head on, too, though, the people using Drupal, there's a whole lot of people using Drupal Secretly. The whole shadow IT thing, I would bet you if you run a Drupal site or any site, half your employees, even unbeknownst to you, are using browser and computer use to do the things that they need to do.

[00:42:33] John: So, uh, I, I have a follow-up question, but I'll let you go first, Nic.

[00:42:38] Nic: Uh, I was just gonna say the, the example that you brought up for Australia, and I think there's been a couple of US-based towns or cities or states that have similar, similar stories. I mean, the, the thing that I think needs to be solved there is what's the liability, right?

You know, I think obviously the company behind the agents is liable, the company behind the people doing the research. And I... And how mu- how liable are the people doing the actual sur- like, that was requesting the data, right? I mean, if you're requesting publicly available data from the Australian Health Medicare website, you're not expecting it to be persistent and find a, uh, a non-production environment, hack into it, and, you know, change database da- you know, do all that stuff.

Do you... H- How, how are you thinking about security, I guess, in the world of agents- Yeah ... and making sure that you're not accidentally sending off a swarm that's doing the same thing? Well,

[00:43:35] Scott: do... Accidentally or purposefully sending off? No, I'm kidding. No, no. No, but, but the, the, the point where you made where you said hacking into, though, is I think that's an important thing, is like I think it really matters.

Like, we are in the era of the equivalent of someone saying, "They hacked my site," and it turns out they looked at the source and you'd put your password in the JavaScript on the page. Like, with a lot of these, like, yes, it's a non- Well, and, and- ... production site, but it's still publicly available.

[00:43:59] Nic: Yeah. And, and- Right

to be fair, AI probably put that password in the JavaScript because it decided that the d- having-

[00:44:04] Scott: No, I just mean- ... the password database ... I just mean years ago. Yeah. So, but, but-

[00:44:07] Nic: Exactly ...

[00:44:08] Scott: yes, there are absolute real cases of AI exceeding their boundaries, but I think in more cases it's just, like, this stuff is lying around and publicly accessible, and, like, nobody really would put the time or go through the effort- Mm-hmm

to get it. That's a different conversation. And, and this gets into, like, why it's gonna become more critical to understand what you publish and stuff there. This is the same, like... I mean, it's an extension of the problem of you have a traditional flat website, and you change something somewhere and you gotta change it everywhere else, whereas if you have a well-structured content management system- Yeah

you can change something in one place and it carries through. Gets into things that are cached. Like, we're gonna start getting to this, like, we see this. Like, can people get to an order form too early? Can they see something that's still cached? Like, all- Mm-hmm ... those problems, and you can reconstruct a big piece of a trial.

That's not hacking

[00:44:57] John: to me. The, the old- That is- The old, like, "Hey, we have a P- we, a PDF on our dev server that we, we have on a page that isn't live yet," and you- Yeah ... you, you were able to figure out what the path to it was and find it.

[00:45:09] Scott: Or the, like, yeah, we, we blacked out in the PDF, but if you just copied and pasted you could get the text underneath.

Right. Right. Is that hacking? Well, you're doing something contrary to their intents, but, like- It's there, right?

[00:45:20] John: Um, I feel like we've had this conversation before. Um, and maybe it was with somebody else, but it feels very, uh... I'm, I'm having a, I'm having a case of deja vu to the point where having a case of deja vu was actually part of the original conversation.

But anyway, um, the other question I was gonna ask you, and, uh, you've said it twice now, is, you know, folks are still gonna need, uh, you know, a content management system, right? And, um, uh, as Martin alluded to at the, the beginning of the show, um, we're both gonna be in New York, um, at Evolve Digital, uh, in the end of November.

I'm moderating a panel with some, some CMS experts, and one of my, one of my questions is, um, you know, uh, in the future are CMSs gonna just turn into like content layout tools as opposed to like content management systems? Um, sounds like you're in the camp of you are still gonna need a CMS, and if you have an AI, an AI-enabled CMS or an AI-aware CMS, you're probably in a better position.

Is that, is that fair to say? Yeah.

[00:46:26] Scott: I, I don't, yeah, I, I don't think it's layout. Um, if anything, like... and this will get into the kind of Rosetta stuff, I think layouts and interfaces are gonna change, and they're gonna be ephemeral. We're gonna have plenty of interfaces that only occur in that moment for that user.

But to do that, it's gonna depend on a structure of the content. Now, I'm a believer that like... and if you were at the enterprise AI summit, sorry, I'm repeating myself here, but like Drupal kind of really is a context management system, and you'll hear Martin talk about this as well. Mm. If you think about the context and how an AI operates, part of it is what you ask and prompt it with, but a lot of it is what the rest of the world prompts it with.

Mm. And part of that gets into the AEO stuff, like you putting the right information forward, but this gets into that same security conversation. Every company has these like workarounds of like, well, you can bypass if you call this tree, or you can get a refund if you do this. Like the agents are going to find that stuff.

So if you cannot understand your information service area, just what you are putting out into the context of the world- Mm ... it's going to be used. That's also your best power that you can use in controlling those. So that's where content management as it relates to context- Mm-hmm ... and the, the myriad of users, some are- Humans using an agent, some are agents using a human, agents using...

It, it doesn't matter and you can't know who's who. You have a service of information you're putting into the world, and you, you want to be able to manage it.

[00:47:52] John: So Christophe, I'm gonna ask you kind of the same, the same question. And, and then, you know, from the, the kind of, uh, inside AI perspective, are you guys looking at, like, tooling to help folks kind of harden their sites against, um, against AI and, and, and, and leakage and that sort of stuff?

And, and I'm assuming that you also believe that, like, content management systems are gonna be, um, very important in the, in the, in the future.

[00:48:23] Christoph: Um, so I think let's start with what, what is a content management system? Yeah. Because like many people think like, you know, of Drupal as a website generator, you know, you have some UIs, then you type something and then, and then you even have like some cool layout functionality, and then it looks like something.

I think, um, that's not what's, what's important. Because firstly, also the traffic on websites is just going down, at least the human traffic.

[00:48:46] John: Mm-hmm.

[00:48:46] Christoph: Yeah. So firstly, like, I mean, most of the questions that you just have that, uh, you know, could be answered from your website will be answered by the agent of the user who has that question already.

So it's the agent that's actually coming, uh, to your site and not the human anymore, and the agent doesn't wanna see any layouts. This needs to have like good interfaces for content. So firstly, like there's two audiences for websites, and one doesn't even require layout. Um, but what both require, like humans and agents, is like consistent content and correct content and safe content.

Yeah. Mm-hmm. And that's actually what, what Scott's saying. So they are, um, on exactly the same, um, uh, page as he is. Like, I think people need content management systems now more than ever, but not for their capabilities of just like looking fancy, but for their capabilities of just like, you know, providing interfaces for humans, editors, visitors, and agents at the s- you know, on the same level, you know, with the same levels of security and just reusing everything that exists already instead of reinventing it.

Yeah. And then like if, if that's the mindset where you are, what is a content management system? Then comes the question immediately like, uh, so where does my content live and what's the source of truth? And I think a content management system is, at least for the public-facing content, is, it's the right position for that because, um, you just have to have all your product information, your service information that needs to live somewhere, needs to be in sync.

You know, like the example we had earlier in this, uh, conversation was about a price that is maybe outdated in a shop. Yeah. So that needs to live somewhere and like be consolidated and recognized somewhere, and that, in my opinion, is the content management, uh, system. At least that's what we are building, uh, Drupal to be, uh, perfect with.

Yeah. So, and- Mm-hmm ... now to your question from, from inside, like there's this whole, um, development effort going on, which is extremely hot for all people building CMS solutions at the moment. That is, uh, that is content review and content governance.

[00:50:40] Martin: Mm-hmm.

[00:50:40] Christoph: Yeah, because like think of all these organizations, like especially decentralized organizations like universities or like large NGOs and stuff.

I mean, they have hundreds and thousands of pages. Yeah. And they just need to find ways how to fi- figure out like what's outdated, what's in sync, what's contradictory. Because if you have on, on your website, you have two claims that are opposite, AI is not gonna decide neither one, because like it doesn't know which one is which.

Yeah. And it's, it's unreliable information. And until now, it was just impossible to just, you know, make your content safe and consistent, but now it is possible. And, you know, the tools to, to- Mm ... make sure that your content is consistent is your content management system

[00:51:20] Scott: Yeah.

[00:51:20] John: Interesting.

[00:51:21] Scott: And he, one thing I'll add to this too is just like, just think of it like all of us listening on this call, that you work in the space, love AI or hate AI, we're living in the future here.

Like, the stuff that you've run into over the last year or two, like that's what the world's gonna be confronted with. So like here in Idaho, there's a lot of agricultural work, right? Go into an agricultural entity IT team and tell them, "Hey, the problem is that on your press release page that does your new quarterly stock results, people in this cache location got it 30 seconds faster than people in this cache location, and now there's huge lawsuits about it," right?

Like, this stuff really matters, and it's just gonna be a huge pain point for a lot of the world. Mm-hmm.

[00:52:01] Nic: Yeah, and I, I think you mentioned something, Christophe, that is the, the piece that, um- Agents can't solve... Maybe they can help partially with it, and you ha- y- this is part of the demo that we talked about in the module of the week, but governance, governance is an, uh, an organizational thing, right?

Um, we were-- I was just talking to a client, a, a potential, well, a new client actually, um, about how they're looking to integrate... They, they like to use AI to generate or write code, little sections of the site, and they have, uh, contributors to the site. And they're like: "Yeah, we don't really have to-- We don't need to silo."

Like, each person gets their own section of the site, and they don't really wanna silo them. They're like: "We trust our users. They're not gonna edit other people's-" Yeah ..."sites." It's like, well, yes. A-and it, on a... You, you can use something like Groups to enforce that, right? So if you have the Group module, you can say: "Hey, this person can only-" Yep "...edit this section of the site.

This person can only edit that section of the site." Everything's fine. And a lot of or- that, that takes configuration, that takes work, so a lot of organizations will just be like: "No, we, we're not gonna in-- We don't wanna invest in the Groups module. We're just gonna make a policy that, 'Hey, you only edit your own department stuff.'"

And if somebody goes out and edits a different department, they have internal tools for managing that, uh, misconduct, quote, unquote. But the question nowadays is: Do you trust their agents? Are they gonna follow that governance? Like, y-you need to almost start enforcing these, the governance decisions with access controls if you, if you have a, um, content model.

And, and like I said, the, the demo that you had, um, one of the points was you can review something for, uh, ba- I think basically the de- I didn't go through the full one, but I think the demo basically flags something for review by somebody. And, and I'm not talking about comments, but like: "Hey, this page might be risky because of, you know, we need a lawyer to look at it," right?

It, it can help with that, but it's not a lawyer, so it can't actually make the, the human judgment call on it yet. Um, the, the governance comes from the organization

[00:54:09] Christoph: I think it's interesting that you mention, like, uh, the example because, like, that's exactly the same examples that, uh, we're seeing at the moment.

I mean, in the past it was just like this and some very large organizations, um, uh, also state organizations in, in the US I've talked to, you know, they just have no rules for who can publish what. They just tell the editors, "Please don't mess up the front page, and you please take care of these pages and not those," and vice versa, yeah.

And that has worked good enough, yeah. We've also built in lots of groups and stuff in the past that it works. It's, it's, it's hard work to just get that working and then train the editors to use it correctly, yeah. So- Yeah ... but, but I think to me, like these kind of things, these are, are more, more t-t-technicalities that now need to be solved more urgently because agents create content at scale, yeah.

Um, but what I found-- find more interesting for organizations at the moment is to review what actually gets created. That's also in itself not a trivial task because if you say, like, somebody writes a piece of text that maybe, you know, somebody could sue you over, yeah. And, um, so somebody has to... A-and that may be even at scale because it's an agent, yeah, then you just need something agentic that just can review that at scale too and actually find that out.

And, um, if you now, like, go back to the demo again, like, um, there is this AI content review functionality available which is not so easy to configure. So if, if you just can't work off a, off a blueprint like the demo, you will probably have a very hard time. But there you see perfect examples of, you know, like an agent looking at a page, you know, and then just, you know, loading from context control center, like some guidelines, some, uh, legal guidelines, some tone of voice guidelines, then iterating on it until it just actually works out, like is this page safe or does it need to, to be flagged with a warning or does it need to be flagged with a, um, uh, uh, with a real error, yeah, for immediate review.

And, um- Yeah ... and I think these kind of scenarios, uh, I think many organizations are, are thinking about right now, at least we see that a lot when we just talk to organizations because that's just an unsolved problem, and that is a-apart from this liability, technical, organizational, um, uh, type of challenges.

[00:56:18] Scott: Yeah. And I add that if you think about, uh, the future of like where people are working. So f- so this idea of attribution to a person and to an organization, think about stuff like the EU AI Act, right? You have to say that it's AI generated unless a person can vouch that they reviewed it, a person of sufficient, like, expertise, and they are tied to that.

So we have this regulatory need right now. But even then, there's nothing that prevents my agent from just saying Scott read that. So that gets into some of the stuff we were talking about earlier about, like, you get up to a certain step and then you have to do your two-factor authentication or your passcode.

I do believe there's gonna be a need for both the providence of who did it and a proof. I don't know if that's gonna be a blockchain type thing, some sort of identification that for liability reasons that when this page says Christophe reviewed it and stands behind it from 1X as a organization, that providence is actually recorded in a way that will hold up in evaluation in the long term

[00:57:17] Nic: Did, did you just find the first actual use of blockchain?

[00:57:20] Scott: Mm-hmm. No. It's just ... That's why I said, "Or something." Um, yeah. Yeah. So basically we're gonna sell NFTs with Kristof on them, and- ... people can post those and that verifies.

[00:57:30] Nic: Um, I, I, I find this fascinating, 'cause you, you ... So you mentioned, Kristof, that the problem isn't solved yet. Uh, just to clarify, I think you mean, like, the scale problem, right?

Because the, the technical problem, it ... That's one of the advantages that Drupal has, right? All the hard underlying framework stuff- Hard ... permission stuff. No, that- that's hard. It took Drupal 25 years to get there. It's hard. Um,

[00:57:55] Christoph: that's the piece- Yeah, no, I, yeah, I meant, I, maybe I, I said this, um, not so good.

Like, I think this is technically solved. You can build- Yeah ... exactly the type of, um, um, um, uh, control systems that just restrict people from doing something they shouldn't. Like, I mean- Yeah ... like, that's why, that's the beauty of us having, like, a, an established, well battle-tested open source software with all the relevant features, and that's also what gives us this headstart- Yeah

or this huge advantage now in the AI area when you just add AI functionality to it. Yeah. So I think that's solved, but because it is this hard problem to solve, many chose not to solve it back then- Yeah ... and just rather, you know, outsource this to the, to the human layer by people just having to agree on, like, do this and don't do that.

But this is not- Yeah ... possible anymore because, like, content is now being generated at scale, so nobody can just look at 1,000 photos or 1,000 blog posts and just check if there, if there are any legal problems in there, but AI can, and Drupal has the tools for it, and it's called content review, and you can just do that.

Yeah, and, um, I think that's something that's gonna be really interesting for website builders in the-

[00:58:55] John: And- ...

[00:58:56] Christoph: next months and years.

[00:58:57] John: And to clarify my air quotes, I mean, I think Drupal has solved a lot of hard problems, but there are harder problems that Drupal is going to be able to solve in the, in the, in the future.

[00:59:09] Christoph: Exactly. And, and organizations are requesting that today. So I think, John, also you earlier said, like, you asked Scott, like, what use cases are you seeing for outside AI that maybe have been solved already? Um, I mean, what we see a lot, like, usually when you just build a new website, the content comes from somewhere, maybe an old website, or maybe you're consolidating, like, a couple of WordPress websites and something else into, like, one nicely governed Drupal instance, yeah?

And, um, so that's where you see this already that, like, stuff is being loaded from other places, and then- pushed into Drupal, be that now via JSON API or Migrate or MCP. Yeah, and MCP is of course the go-to technology because, um, that's like how agents work natively. So here we are just in the beginning. So what we are already seeing in, with our clients is that we expose their features via MCP so that they can integrate them into their own tooling.

So for example, if you just operate an intranet and there are some guidelines in there, like how to apply for vacation or something, you know, that should of course be exposed as, uh, MCP and by default connected to all the agents so that, um, so that, uh, employees can request, you know, um, a vacation right there.

Yeah. Or maybe sales tools that just like pull product data. Yeah, so when the sales agent is just like the, the salesperson in the field is just, yeah, preparing something on the fly for a client that has access to all this information in live via their agents, you know. So that kind of functionality, that's what they're requesting today.

[01:00:41] Nic: So what, what are, um, we, we just talked about how some of the hard permission problems and things are solved, but we, we just have to make we just have to get them set up, uh- I have

[01:00:53] Christoph: to move a little bit to get the light back on here.

[01:00:56] Nic: Yeah. So w- we have, we have to do some work to make it, uh, maybe add some recipes around these and make it easier to implement some of these.

But Scott, I, I'm curious, since you're, you, you've been on the bleeding edge for a long time now, what are some of the, what are some of the big technical challenges that the community's gonna face moving forward? Um, yeah, what are we looking at?

[01:01:20] Scott: Uh, the Rosetta spread. So let me explain what that is, and I think this is, like, the big one I'd love the community to get behind.

If you watch the Dries Note, Dries talks about this a little bit. Um, but here's my background that I ran into, and a lot of people have run into this in similar ways. So I put together the agent access stuff. I was super excited. I got it connected to chatgp.com. I'm like, "I'm in. I'm in Drupal. This is secure.

It's using all this industry standard stuff. Let's see what I can do." Record scratch, I can't do anything, right? Because for a very long time, we've done a very good job in Drupal of exposing data and exposing rendered kind of front ends. We have not done a good job of exposing the logic, right, the functional capabilities.

Those are very much tied to other places, most notably forms. So there's a lot of assumptions in Drupal that a lot of, uh, things live in forms or on a route, and now you're in this interface world where you don't have to have those anymore. So even examples of, like this, of when you log into Drupal and you can see who you are and that you're logged in.

Right now, there's a rest endpoint that's a one or a zero if you're logged in. Traditionally as a, as human user, you'd be taken to a page that says if you're logged in. Every interface needs that kind of capability, right? Similar to things like uploading a, a media asset. A lot of the validation of a media asset on size, anything, is configured and tied to a form.

Well, now you're uploading ways that there are not forms. The end result that we want out of Rosetta is- As a developer, you should just be able to implement your functionality, and if you call the Drupal APIs the correct way, similar to that we do with the entity system or anything else, it will just work and you don't have to worry about the interface.

This is what Drieu showed in his gallery example. It was 1,000 lines of not even boilerplate to get it to work. It's more important than boilerplate because it is access controls and things like that. So if you're making a tool to expose it to, like MCP, you're largely gonna be responsible for dealing with that kind of access step, and we don't want people to have to do that for every single interface.

So that's the big one ahead of us. So if you're interested in this space, get involved in the Rosetta Sprint. Um, the end result is ideally someone can develop functionality in the module and you don't have to worry about what interface it's gonna work in. It could work in JSON API, it could work in a forum, it could work in MCP, it could work in a headless implementation.

But it's a lot of work.

[01:03:52] Nic: Hmm. Christophe, anything you'd like to add?

[01:03:59] Christoph: Um, what just c- came across my mind is, like, um, John, you asked in the beginning, like, how does, uh, inside and outside, how does it work together? And it's just really two sides of the same coin. 'Cause what, uh, what Scott's describing is, like, so we build functionality.

We just, you know, add to our system new functionality, and that should just work for editors and agents at the same time. Yeah. Automatically. Like, you shouldn't have to, as a module maintainer, I shouldn't have to learn, like, how to implement new interfaces to expose your functionality as this and that. Or, like, you know, have, like, complicated ways of just documenting things or, or, yeah.

So it should just, it should just work. And, um, and I think it's possible. I mean, it's a lot of work because now we're just not touching individual functionality, we're touching all of Drupal. But, um, I mean, think of going forward. There's this content management system that you can just completely configure and operate via agents or manually, you know, here locally or elsewhere.

I think this is crazy cool.

[01:05:02] John: Hmm. I am gonna ask, uh, a question, and I think, Scott, you're gonna answer it the same way. But I'm gonna, I'm gonna take a, I'm gonna take a crack at it. Um, so we talked about challenges. Let's talk about interoperability a little bit and the fact that, like, AI is moving at a rapid, rapid pace.

Um, people are saying like, "Oh, AI should slow down." And, uh, other folks are like, "Heck no, keep going," right? Um, I'm wondering how, uh... Well, first of all, I'm wondering how Drupal keeps up, right? Uh, and then, um, I'm wondering, like, w- what does it, what does it look like to keep up with these, with these AI providers and the new models and the new features and the new, the new agents that they're putting out?

Is it, is it in fact, like, you know, doubling down on, on Rosetta and getting that, that done so that way we have kind of a unified, uh, way of, of talking to them? Um, or, or is it something else?

[01:06:07] Scott: Yeah. I mean, we're in it. I don't think it's gonna slow down. Uh, I don't think people are gonna change. You know, anytime I hear an answer that's basically like, you know, let's just change human nature, like, this is kind of where we're at.

Things are gonna continue to accelerate and continue- Mm ... to move fast. But there leads to a ton of opportunities, right? You're hearing so much from the business community now, like, this feeling that the risk of the AI are starting to outweigh the rewards, right? True or not, you can't... That's what it is.

You can't be like, "We're gonna stop it," 'cause the world as a whole's not gonna stop it. So there, there's real risks. This is the same risk we saw again, like history repeats itself. This is the same user-generated content cycle to some extent, right? Uh, s- to some extent, even the same conversations. Like, back then it was like, "Nobody's gonna need a website.

We're all gonna be on Facebook." Well, that didn't happen. The whole thing just grew and got way more complex. Mm-hmm. Same problems. Like, what does this mean? We saw amazing, phenomenal things that came to the world because of user-generated content, and some really bad stuff. That's what we're on track for, right?

[01:07:10] John: Yeah. And so- So now, now you're seeing, now you're seeing, "Oh, I don't need a website. I'll just use the AI." But the AI then has to go to your website to get that structured content to feed back to the person, right?

[01:07:20] Scott: Or you do what a lot of people did. It's like, "We don't need a website. We're just gonna go to Facebook," and that's all well and good for the moment until you're in this walled garden, and now you're beholden to Facebook.

And you're like, "Oh, that was a bad mistake." And this is the thing. Like, was it the death of journalism and the news industry? No. A lot of titans of the era are no longer there, but journalism and writing and news and communication is higher than it's ever been. Mm-hmm. And we're gonna see that, like, pattern over and over.

So there's gonna be winners and losers in this, right? Absolutely, and I think that's the thing. Like, to me, it's definitely gonna come down to speed- Mm ... agility, right? Things are moving a whole lot faster, so it's... W- we've gotta be the thing that both we can move quickly and we can give other people. Like, that, you know, th- these product owners and people that would choose to use Drupal are stuck in this middle of marketers who are saying, "I could just vibe code this."

And it's like, great- Yeah ... because you could, but you don't have to maintain it. They have to maintain it, and they're the ones that get yelled at when the regulators call, right? So we can meet that need.

[01:08:19] Nic: Well, so- I, I will... S- sorry, Scott. I will say that one, 'cause one of my clients is talking specifically about that, um- that problem space, right?

They have-- And it's not even just marketers, right? They have a lot of really talented engineers, they have a lot of really talented product owners. Like it's, it's not even just like people that don't care about the product that they're selling, it's just they need a tool to help them do something. And they're, they're vibe coding or generating these tool sets, and we're talking about how do we, how do we support something like that without just, yeah, without regulators coming to it, without accessibility issues, without GDPR, without privacy concerns, without also, all sort of security concerns.

And one of the things that we're talking about doing, and I'd be interested to hear if you think this is a good idea or not. But one of the things we're talking about is, um, two things. One, they'll be the owner of it, they will have to maintain it. So we'll, we'll point all of our auditing... Like we have a bunch of auditing tools we point for like security and compliance and accessibility.

We'll point those at it, and if they're not compliant, they'll have to make it compliant. The other thing that we're doing is we're putting a time limit on a lot of these things. So basically, um, I forget, it would be like a, a exponential decay. So like when they first put it up, it'll stay up for 30 days, and then we'll shut it off.

And if they complain, that means that they, they were still actually using it for 30 days. We'll turn it back on for 60 days, and then we'll shut it off after 60 days. 'Cause a lot of the times people, people that vibe code something, they realize shortly after that it doesn't quite do what they want or it's too much effort to maintain or, you know, it doesn't, it's not as useful as they thought.

And so in, in the old days, it would just sit up forever, and then five years later be like, "Where's this thing? Is anybody using it?" And you find out nobody's been using it since the day it went up, right? But if we, if we automatically turn it off, we- But- ... we don't have these things up for forever, uh, only if they're using them and maintaining them.

[01:10:24] John: Nic, why not take a strategy of like the vibe coded thing as like a POC, and then like the development team actually builds or, or modifies the vibe coded thing to, to be- Yes ... like a full-fledged

[01:10:36] Nic: thing. So, uh, so the development team is 6 people, and the company is 5,000 people, and approximately- Mm ... 3,000 of them are building POCs.

No, no, we can't even... We, we- Got it ... even before all these proof of concepts, we had a backlog. Um, and like I said, most of these proof of concepts are the kinds of things that they think, "Oh, this is a great idea. I want it." Then they're never gonna use it again. Then they,

[01:10:59] John: then they use it and they're like, "Eh, this wasn't as

[01:11:01] Nic: useful as I thought it was gonna be."

Yeah, it doesn't quite work.

[01:11:02] John: Yeah,

[01:11:03] Nic: sure. And, and if, if they do a proof of concept, we tell them, "Okay, great. Your number is 692 in line. We'll get to you sometime in 2035." That's not-

[01:11:12] Scott: Yeah ...

[01:11:13] Nic: really sustainable either.

[01:11:15] Scott: Well, I think to your point, John, flip it. Flip the equation. Don't be, "We've vibe coded this," and then devs take it over.

Devs provide something like a content management system that allows vibes within- Yeah ... guardrails for that, and you can make the things that you want-

[01:11:27] John: Yeah ...

[01:11:28] Scott: on it with auto expiry and all that stuff.

[01:11:31] John: So Kristof, I was gonna ask you about interoperability and, like, inside AI and, like, keeping all the things working for people that are keep creating content.

But, um, I'm kinda wondering now, like, as I'm listening to this conversation, we, we, you know, I asked, like, are content management systems gonna be, gonna be a thing, and, and you both kind of emphatically said, yes, they are, but they're gonna have to provide more context to AI. I'm wondering, like, you think in the future, uh, Drupal will be, like, an AI management system as opposed to a content management system or, like, a, like, a AI, a hub of some sort?

Because honestly, like, listening to you guys talk about this, it sounds like, yeah, we're developing content, we're building AI tools to help develop content, but we're also building a place where you can kinda interact with different, different AIs to be able to either provide information out to the, out to the world or create information for, for sharing with the world.

[01:12:33] Christoph: Um, it's, it's a good question. I mean, it, it's also resonates with me with an older question like, well, what does Drupal do? You know, Drupal is a system that with which you can build content management system, but literally also everything else. Yeah. And, um, and that goes for AI too. I mean, Drupal ships out of the box a full-blown agentic infrastructure.

You can just build agents in there using the UIs, and you can just access all of Drupal's functionality as tools, and you can just connect this to any AI provider that you want. So in theory, you can just, like, use Drupal to just build, like, whatever agentic that you want. Mm-hmm. Maybe some people will do that.

Um, will that be the future? Is that where, uh, Drupal should go? If you ask me personally, I don't think so. I think Drupal should be very strong content management system, and that has enough requirements for agentic use cases, uh, already. If you just think about this whole problem space of having good content that's governed, that's safe, that, you know, um, that can, that can be accessed from via all kinds of interfaces, I think that's already a, a huge challenge, and that's a challenge that every organization in the world has because every organization needs to broadcast their information to the world and to the agents, to the people.

And so I think that's where we should focus. But in theory, like what we have in Drupal, you can just, like, use this as a AI building tool, just like any other AI tooling framework out there.

[01:13:58] John: I mean, uh, and I think we just talked about, like, Nic's gonna, Nic's gonna use Drupal as a, uh, a vibe coding, you know, safe space for his clients, so people can go in there and vibe code their, their thing, you know, with guardrails and all this stuff, right?

Like, that's a free idea, Nic. You can take that and run with it. But, um, you know, I, I mean, I think that's, that's i- an interesting piece of this where, yeah, you still do need the content management system. Drupal's really good at content. It's really good at translation, but now it's also really good at managing AI and, and, and those, those interactions and providing a-

[01:14:34] Christoph: I mean, the way you extend content management-

safe space ... in my opinion is, like, that you just, like, you, you look at content management as being a flow because, like, there are people Or, you know-

[01:14:46] John: Yeah ...

[01:14:46] Christoph: people or agents that are just creating content based on something. You know, like there was an event- Right ... and there was maybe some video footage, there was some interviews, and then somebody needs to write a blog post around it, and then put this on the website in the correct places, and then link it from the correct other pages.

Yeah, so that is just a pipeline of work that just, like, comes from, like, getting all the data, like getting the idea, getting like a, a storyline, then providing the first, uh, content, and then just having design run by, and then put this through the website, then, you know, bring it out there, and then make sure it's correct and compliant.

Um, and I think that's what content management is. It's not only, uh, content management in the sense like this is a news page or this is like a product page. Yeah. I have these news, I have these products. You know, that's, I mean, it, it's the, it's, it's the flow. Like, it's the content creation and content delivery end to end that, you know, Drupal should be really strong at governing and, and that's what we're working towards.

And then, and I mean, it, I think it's a fantastic system to do this, and I think that's where the focus should be. You can also build other kind of workflows, yeah, and there's, I mean, there's no limit But, um, uh, I think that's where we should focus as, uh, as Drupal content management system. We should perceive it and use it as a content management system.

[01:15:56] John: Yeah. I, I think, um, you know, I feel like our, our AI future is bright with, with both of you, uh, both of you kinda guiding, guiding the direction. Scott, I'll give you the last word, and you only have one minute. If folks wanna get involved with either inside or outside AI in Drupal, how can they do it?

[01:16:16] Scott: Yeah, um, first one ask, people that disagree with Christophe and I about the future of CMSs, I would love to hear it.

Like, obviously we're a suspect. We're both in the pocket of big CMS, right? Like, we, we have a, we have a vested stake in this, and I do wanna hear from people that say, like, "No, I don't think there is a future of a content management system for this reason." There's not enough of that voice either, right?

Like, and that's what we as Drupal need to anticipate against. Mm-hmm. If you want to get involved, there is just a ton, e- even if you're not interested in the AI space, like, things like performance. Take a, a content editor. Like, we have teams that have hundreds of editors across hundreds of sites, and right now they publish a couple pieces of content a day.

You make them AI-enabled, and now they're publishing 1,000 pieces of content a day. What does that mean from even just, like, the pers- performance impact? All these assumptions we've made over the years that have changed. Rosetta, the Rosetta Stone is an absolutely fantastic way to get involved in that. Um, join the Rosetta room in the Drupal Slack if you wanna get involved, and there's just gonna be a whole world of that.

Get involved in the tool API ecosystem, MCP, test all the bases. So that's where I- Perfect ... I'd have plenty to do. Plenty to do, so.

[01:17:24] John: There you go. Christophe, Scott, thank you for joining us. It's always a pleasure. I feel like we coulda probably filled another hour worth of, worth- ... of interesting conversation, so we'll definitely have to have you back soon.

[01:17:36] Nic: B- b- before we close out, I wanna say Baddy said hi too, and thank you for, uh thank

[01:17:41] Scott: you. No, Baddy should be asking Christophe hard questions, like when are you coming to do the dishes, things like that.

[01:17:49] Christoph: Oh, no. I mean, clearly

[01:17:50] John: he's still

[01:17:51] Christoph: at the office, so it might be- Yeah ... it might be a myth. I think she, I think she's walking around somewhere there.

[01:17:55] John: Oh, wow. Perfect. If she's, if she's listening-

[01:17:57] Christoph: She watched, she can come

[01:17:58] John: say hi ... she can, she can s- get in a, get in the video

[01:18:00] Christoph: under-

[01:18:00] John: Two minutes left Next time, Baddy, hard questions for Christophe on the air. That's rule one On the air.

[01:18:04] Christoph: Yes, please.

[01:18:06] John: Don't forget to reach out to us on Drupal Slack in the Talking Drupal channel, or email with [email protected].

You can also promote your Drupal event, sponsor an episode, or become a guest by visiting talkingdrupal.com and clicking the buttons in the sidebar. And thank you patrons for supporting Talking Drupal. Your support has kept us talking for now 576 episodes. All righty. Christophe, if folks wanted to get ahold of you, how best could they do that?

[01:18:36] Christoph: Um, you can find me on Slack, on, uh, t- Drupal org s- or Drupal org Slack. My username is breider, so is my Drupal.org username. Um, that's probably the best way.

[01:18:48] John: And, uh, is it 1xinternet.com?

[01:18:51] Christoph: Yes, it is.

[01:18:52] John: There you go. Scott, what about you?

[01:18:55] Scott: Uh, Slack, just as Scott Falconer. Um, and then LinkedIn is a good one, so.

[01:19:02] Christoph: Yeah, LinkedIn is of course for me as well.

[01:19:04] John: There you go. Um, oh, Patty's already gone, gone home. She's, she's taking care of some, some food. She

[01:19:10] Christoph: claims that she has food at home, but it's not true.

[01:19:13] John: There, there we go. Okay. She's trying to get

[01:19:14] Scott: him off the air. Like, "Come

[01:19:15] John: home, I've got food." Look, listen, I, I it's lunchtime o- here. So she said food, now I'm hungry.

Um, Nic, where can folks find you?

[01:19:24] Scott: At Chris'

[01:19:24] Nic: house, five minutes for dinner. You can find me pretty much everywhere @nicxvan, N-I-C-X-V-A-N.

[01:19:31] John: And I'm John Picozzi. You can find me personally at picozzi.com. You can find me on the socials and drupal.org @johnpicozzi, and you can find out about EPAM at epam.com.

[01:19:42] Nic: And if you've enjoyed listening, we've enjoyed talking. See you guys next week.

[01:19:46] John: Have a good one, everyone.