fidzu : php

By Scott Falconer, Product Lead, Outside AI

Where Drupal really stands with AI agents, where it has a right to win, and what we need to do next.

AI agents can build with almost anything. That is both great news and a problem for Drupal.

A person can ask an agent to recommend a platform, rebuild an existing site, create a content model, configure permissions, or change a running system. The agent then has to decide whether Drupal is a good path, reach it, understand it, act on it, and verify the result.

When that experience fails, we usually do not get a bug report. The agent works around Drupal, produces something that only looks finished, or quietly chooses another stack.

That makes agent experience a growth problem for Drupal, not just a developer-experience problem.

Drupal does not need to be the fastest way to generate any page. Drupal should be the safest, clearest way to a governed, inspectable, long-lived site - and agents should be able to use it effectively.

By governed, we mean the controls that make a site safe to run and hand off - a real content model, scoped roles and permissions, review and audit, safe rollback - not just quick to generate.

This is the purpose of Outside AI, the workstream the Drupal AI Initiative launched: making Drupal legible, callable, safe, and verifiable for agents and builder tools operating from the outside.

The distinction from Inside AI, in shorthand:

• Inside AI: a person uses Drupal, and Drupal uses AI to help.
• Outside AI: a person uses an agent, and the agent uses Drupal.

These are different experiences, but they need substantially the same foundation: clear state, stable interfaces, scoped identity, governed actions, and reliable verification. Wherever possible, that foundation should be built once in Drupal and shared by both.

Our goal is not to make Drupal better for agents instead of people. It is to make Drupal's existing strengths explicit enough that both agents and people can safely use them. If we are successful we will make Drupal's strengths visible and attainable - improvements that hold no matter which agent, model, or tooling wins.

Where Drupal really is

Early measurements from the Drupal Agent Readiness Scorecard point to a tricky but useful conclusion: capability is becoming table stakes.

Our first-hour study drops a cold agent onto each platform with no prior setup and measures how fast and how reliably it can stand up a small but real structured, permissioned site. The bar: a content model, seeded content, a public page, a scoped editor role. Every milestone is confirmed by an independent HTTP probe, not the agent's own say-so. Agents cleared that bar on every platform we tested: Drupal CMS, bare Drupal core, WordPress, and a from-scratch Node app (each across multiple models and two agent families), plus single spot-check runs on Wagtail, Joomla, Strapi, and Payload.

The evidence is still early and deliberately narrow - and the scorecard is useful for direction, but "can an agent build with Drupal?" is no longer an open question.

The better questions: when should an agent choose Drupal, how far can it reliably get, and what is left after the agent is done?

Drupal has an advantage here. It was not designed for agents - but it was not luck, either.

For two decades, enterprise and community pressure forced Drupal to care about structured content, relationships, roles and permissions, editorial workflows, configuration management, APIs, and migration. Complex digital experiences demanded structure, governance, and safe ways to change things, so the community built them.

Those are exactly the things agents need: structured state they can inspect, explicit permissions they can reason about, actions with known boundaries, configuration they can hand off, and evidence that a change worked. The foundation was already here. AI is now revealing why it matters.

And agents do find it. In the study's Drupal runs, agents reached for native capabilities - content types, roles, permissions, Views, exported configuration - instead of bypassing Drupal with a static lookalike, and what they left behind was inspectable. That evidence is promising, but as Dries wrote about Drupal's role in agentic workflows, a head start is not a plan to win. What this post attempts to measure is where the head start is real, where it is not, and what we need to do to turn it into a win.

Drupal still makes agents work too hard to reach the advantage. Setup choices, authentication, module selection, stale assumptions, unclear action surfaces, and weak verification can consume the whole first session before Drupal's strengths become visible.

Agents do not reward us for architecture they never reach.

The advantage is made of decisions

Drupal core, contrib, and products like Drupal CMS are best understood not just as software, but as an accumulation of hard-fought decisions by many dedicated individuals: core is the architectural commitments (structured content, revisions, granular permissions), contrib the solved problems (search, forms, spam, SEO), and a product like Drupal CMS the curation - which of those a serious site actually needs, working together from day one. That accumulated judgment is the real inheritance, and the hard part to reproduce on any stack.

What makes those decisions unusually legible, inspectable, and reusable - without reading the code that enforces them - is that Drupal represents most of them as structured configuration: data with a schema, exportable to files, reviewable as a diff, and inspectable on a running site. Content types and fields, role grants, Views, editorial workflows - they all live there. That standard is the point: Drupal gives decisions a common, inspectable place to live. On a from-scratch build there is no such defined place - a decision may sit in code, a migration, an ad-hoc config file, or only in someone's head. On some headless CMSs, even the access rules are code. Drupal keeps an unusually large share of the decision surface legible as data.

That is what a human actually inherits from an agent-built Drupal site: decisions they did not know to ask for, in a form they can inspect and safely change. An agent building from scratch gives you exactly what it thought of. An agent building on Drupal CMS hands you the community's accumulated judgment - core's architecture, contrib's solved problems, the product's curation - as artifacts you can review, compare, export or change through the admin UI or by applying a recipe, without a developer touching code. When we verified agent builds, we did not take the agent's summary - we read the configuration. Decisions-as-data is what made that possible: legible, deployable between environments of the same site, composable across sites as recipes, and checkable by someone who was not in the room.

This is where Drupal's advantage can also become fragile - a decision can be structured and still be lost, bypassed, or stripped of its rationale:

• The config/code boundary can be a failure point. Configuration declares a desired state that one line of code can silently bypass. The access-coverage probe (which requests a restricted resource through every serving path an anonymous user could reach) found exactly this shape: custom code called ->accessCheck(FALSE) on an entity query and then exposed the returned entities without a later entity-access check, bypassing the access filtering the site otherwise expected. A site's true behavior is the intersection of config and code, and verification that reads only one layer misses the other.
• Configuration records what was decided, rarely why. It can carry labels, descriptions, and dependencies, but there is no first-class model for the rationale behind a decision or how future changes should treat it. The hard-fought decision arrives stripped of its reasoning.
• Configuration does not defend the intent behind a valid change. It can defend structural validity and dependencies, but not the human judgment a change quietly discards. In the recipe-composition tests - where we combined recipes that touch the same settings - two recipes applied conflicting config actions to the same property and the later action won mechanically. In the intent experiments - where we recorded the reason behind a design decision in the site itself, then asked a fresh agent to make a conflicting change - agents read the stored rationale and then removed the very affordances it was meant to protect.

So "those decisions aren't lost" turns out to be an assumption, not a guarantee - in these tests, it did not hold on its own… but the answer is not to freeze the decisions: the agent acts for the user, and sometimes changing one is exactly right. In the intent experiments the rationale was in the site, and the agents even read it - it still never entered the change. Our bet is timing: move the reason to the moment - keep it attached to the work, and put it in front of the agent exactly when it is about to change what that reason protects. The agent may still make the change; sometimes it should, but it is a tradeoff the agent had the opportunity to evaluate with the right context at the right moment.

And the stakes are rarely one big decision. A long-lived site is changed by many actors over many years - people and agents, each change small on its own. No single lost decision reads as damage; the damage is the trajectory. Small silent losses compound, change after change, until the governed site someone carefully built has drifted into something nobody chose. The advantage accumulated one hard-fought decision at a time, and it erodes the same way - which is why the lever has to sit at the moment of change, the same granularity where the drift happens. The advantage is made of decisions, for as long as you can remember them.

Where Drupal has a right to win

The Playing to Win choice cascade rests on one premise: strategy is a choice.

A disposable landing page, a one-off prototype, or a deeply bespoke product where a CMS addresses only a small slice of the job may be better served by a different stack. Drupal does not need to win every prompt to win the work it is built for.

This is the practical consequence of the great CMS unbundling: AI commoditizes creation while raising the value of control - it lowers the cost of creation, not the cost of trust.

Drupal has a right to win when the result must remain understandable and operable after generation:

• Content-rich sites with a real editorial model.
• Sites with multiple roles, permissions, and approval boundaries.
• Sites that must ensure high quality and accurate content.
• Long-lived systems that teams of people and agents will change.
• Rebuilds and migrations where the source site's decisions cannot simply be discarded.
• Projects where configuration, deployment, auditability, and recovery matter.
• Sites where "it looks done" is not the same as "it is safe to operationalize."

This territory is defined by the work, not the organization's size. A small nonprofit can need strong editorial governance. A large enterprise will often find a disposable microsite sufficient for the right use cases.

In the language of the cascade:

• Winning aspiration: Drupal becomes the clearest, most trustworthy CMS choice for an external agent building a real, governed site.
• Where we play: work where structure, governance, handoff, and long-term operability matter.
• How we win: close enough of the first-session gap that Drupal gets considered, then prove the result is more inspectable, verifiable, and trustworthy.
• Capabilities we need: start and connect, understand the site, act through governed interfaces, verify and recover, and rebuild or launch through a repeatable path.
• How we measure it: fixed tasks, real running sites, retained failures and nulls, and independently checked outcomes.

How this gets more people to Drupal

Drupal's historical adoption barrier is not that it is powerful. It is that reaching the power has usually required someone who already knows Drupal.

A committed Drupal agency invests through that friction because it knows what is on the other side. A WordPress shop that occasionally considers Drupal, a system integrator with many platforms to choose from, or a lean in-house team may not.

AI can lower the expertise barrier - but only if the results can be trusted.

If an agent can absorb more of the repeatable setup and assembly, while experts review the consequential architecture, business, and governance decisions, then Drupal expertise moves up the value stack. Talented people spend their time on customer experience, editorial strategy, integrations, and the decisions that actually differentiate the site.

Prove that path and the agency pitch changes from:

We can build this after a substantial discovery and setup phase.

to:

We have already built a governed starting position. Here is the architecture, what we learned from the source site, which Drupal decisions we inherited, what we verified, and where expert judgment is still required.

That is a stronger way to enter a rebuild conversation - and it is how Drupal becomes a realistic choice for teams that do not already have deep Drupal expertise in-house.

It is still a strategic bet. We have not demonstrated that better agent experience produces Drupal adoption at scale, and we should not claim the market outcome before we have proven the mechanism. We would know the bet was wrong if agents kept bypassing Drupal's native capabilities even when they were easy to reach, if inspectable artifacts did not measurably cut a second team's time to change a site safely, or if entry friction never fell far enough for Drupal to enter consideration at all.

The first session should not require a laptop

Underneath the expertise barrier sits a second one: the environment. Local tooling for Drupal provides an excellent experience - DDEV can stand up a real site in minutes for someone who lives in a terminal. The same first-hour measurements ran on exactly that tooling, and even there, install weight - not capability - set the pace. And that is the expert path: it assumes a capable machine, a terminal, a container runtime, and the time to configure them. A growing share of first evaluations do not start there. They start on a phone, in a browser tab, or inside a chat window - often mediated by an agent that has no local machine at all.

No amount of polish can remove that local barrier. And to be clear, this is not a criticism of tools like DDEV - DDEV should remain the expert path. But if the only way to try Drupal is to install Drupal, we lose the people - and the agents - who were only willing to spend five curious minutes. We risk rejection before the first page is ever built.

That is why hosted try-and-build surfaces matter: places where someone who does not know or care about Drupal yet - or an agent acting on their behalf - can start a real site with nothing installed. Hosted trials, browser-based build environments, demo workflows, commercial platform starters, and one-click hosting paths each attack that floor from a different angle. And each has a natural graduation path: a trial becomes a real site, and a real site launches onto hosted platforms as it grows. The front door feeds the installed base.

This is also where the community structure of the Drupal AI initiative becomes its advantage. No single on-ramp will fit every user, and each provider brings its own vision, market, and opinions - a browser trial optimizes for the five-curious-minutes case, a demo workflow for build-something-real, a commercial platform for launch-and-scale. That plurality is a strength, on one condition: the Drupal underneath must be the same agent-ready Drupal everywhere - the same state introspection, the same governed actions, the same verification. Providers should compete on experience and opinion, not re-invent the substrate.

The standard: someone who has never heard of PHP or SQL - or an agent with no machine at all - can go from curiosity to a real, governed Drupal site in one session, and graduate that site to production hosting without starting over.

What we need to build

From here the essay turns into inside baseball: issue by issue, for the people working with Drupal every day. If that is not you, feel free to skim, or skip to the closing.

The Outside AI roadmap follows the journey an external agent has to complete - the same path Dries has sketched, from setup to connection, context, governed action, validation, recovery, and launch. These five stages assume Drupal is already in the running; getting there - an agent discovering Drupal, recognizing the task fits its territory, and reaching a starting surface before any Drupal site exists - is stage zero, and it is what the front door and self-description work above are for. In the below, we focus on what we should be able to say, with evidence, before calling it done. And wherever external tooling has to keep explaining the same Drupal quirk to an agent, that quirk is a roadmap item: the workaround is the requirements document.

1. Start and connect

An agent needs supported ways into Drupal and a scoped, auditable identity - and there is still a lot to decide in what that identity can be. An agent can act as a delegate, carrying a scoped slice of the authority of the person it works for. Or it can act as an independent, non-human account with grants of its own - a principal actor. These are two different models of what an agent is, with different strengths: delegation cannot exceed the person it acts for, which keeps the blast radius small and the audit trail human-shaped; an independent identity can carry work no single person's permissions cover, like scheduled maintenance or operations across many sites.

Drupal should not pick the winner. Products, hosts, and teams will choose differently - reasonably - and the same site may run both. From the substrate's side, the fork matters less than it looks: both models need the same structure - a grant that is scoped, an action that is attributed, a denial that is auditable. Build those once and either model, or both at once, can run on top.

The mechanics are arriving. The core CLI entry point (vendor/bin/dr) landed in Drupal 11.4. Work on the execution principal, OAuth behavior, and MCP scope enforcement continues across the initiative: the execution-principal plan, OAuth identity work in Simple OAuth, and scope handling in the MCP Server module. No single entry point serves every environment: dr is a local and server transport, while a remote agent needs authenticated HTTP or MCP. What has to stay constant is the contract - the same action, authorization, and receipt model, reachable through the right transport for each.

The standard: given an agent operating under a scoped grant - delegated from a person or issued to a non-human identity - when it attempts an allowed action, the action succeeds and is recorded against an execution principal that names both the initiator and the executor. When it attempts an action beyond that grant, it fails clearly, safely, and with an auditable reason.

2. Understand the running site

The agent should not have to guess what Drupal or the running site can tell it. We need supported, machine-readable inventory, site structure, API and schema fidelity, path ownership, available actions, and current constraints.

The standard: given a running Drupal site, when an agent requests site context, it can discover content types, fields, roles, permissions, workflows, path ownership, enabled extensions, available actions, and relevant constraints - without scraping the UI or guessing from routes.

3. Act through governed interfaces

Agents need typed inputs, predictable errors, least-privilege execution, approval boundaries, and results another system can inspect.

This fundamental is one Drupal's entity layer already demonstrates: authorization attaches to the operation, not the entry point. An editor does not write to the database - they work through forms their permissions allow, and when a change goes through the Entity API, the same permission and entity-access checks fire whether it arrived from the admin UI or the API. For agents, that is the right foundation: no separate "agent mode" to secure - a new caller walks through a new door and hits the same wall. It is not yet universal: some checks still live at the door, and the command line has historically carried implicit authority - which is exactly why the execution-principal work in stage one matters. Part of the roadmap is making the fundamental universal, not inventing it.

What is missing is declaration, not governance. Entity CRUD is well covered - JSON:API exposes entities as resources under the same policies. But the operations beyond CRUD - clear a cache, apply a recipe, run a migration, reindex search - are scattered across admin forms, Drush commands, and one-off endpoints, each with its own shape. An agent cannot reliably discover what operations exist, what they require, or what they return; efforts like the Tool API and tool declaration introspection are working toward that declared catalog. The requirement is the fundamental, not any one module: one action model, many doors - typed inputs, the same authorization, and a structured receipt from every transport. A receipt, though, is still a claim - judging it is the next stage's job.

The standard: given one declared site action, when an agent calls it through any supported action adapter - CLI, MCP, ECA, or Drupal's AI systems - its typed inputs, authorization, errors, and result receipts behave consistently. Where an operation is entity CRUD through JSON:API, the same identity and authorization policies apply.

4. Verify and recover

The agent's own summary should not be held as proof - we would never expect a human to be the ideal judge of their own work. What matters is what the site actually shows. That is not a new problem: Drupal has always worked on it, because Drupal was never just for managing content - it manages how a team works together. Work does not count until someone else - or a system-enforced guardrail - says it does: drafts, moderation states, revision history with rollback, a permission model where the author does not have to be the approver. An agent is the newest actor in that system: it proposes within its permissions, the workflow gates what counts as done, a different actor approves, and revisions makes it reversible.

That machinery is fundamental to Drupal for content. For code and configuration, teams already have a mature review lane too - it just lives outside Drupal, in version control. And Drupal is unusually well placed to use it: because configuration exports to files, a config change can ride the same discipline as code - a diff, a pull request, a reviewer, CI, a revert. That is decisions-as-data paying off; most platforms cannot put their settings in a code review at all. An agent that works like a developer - building locally, exporting configuration, committing - inherits all of it.

The live site is the harder case, and not just for agents: a person doing site-building on production creates the same risk. Teams manage it by deciding where each kind of change is allowed to happen. Content is edited live, because live content has mechanisms for review. Structure is built in a development copy and flows to production through configuration import - so a config change made directly on production is temporary, and the next deployment erases it; some teams block live config edits outright. Giving an agent the same working agreement needs nothing new: a role that edits content on production, a freer hand in a development copy, the config path in between.

Two things are new though, and as a result they are the roadmap. First, the working agreement has to be explicit. Teams usually write it down for people - onboarding docs, locked-down production, review - but with agents, every session can be somebody's first day on the site, so anything left as "on the job" knowledge repeatedly fails fast. The boundary has to be stated by the site, and feedback given when it is enforced; the explicitness a cold agent needs is the same explicitness that protects a new hire.

Second, speed and scale. Where a team produced a handful of reviewable changes a day, agents can produce thousands. Human review alone does not survive that volume. Independent, automated verification has to absorb it - machine checks covering the routine, so human attention lands on the judgment calls. AI observability can trace requests through standard logging and telemetry, but tracing a request is not the same as independently verifying a change or rolling it back; the checking itself has to become machinery.

Our work is to extend the team discipline Drupal already applies to content - draft, review, approve, revert - to every surface an agent can change, at a speed and scale no site team has faced before.

The standard: given a change the agent claims is complete, when an independent process inspects the site, it can confirm what changed, show which content, configuration, code, or workflow surface was touched, report whether verification passed, and provide a preview, rollback, or recovery path.

5. Rebuild, migrate, and launch

The same governed path has to support a real way onto Drupal and a real handoff toward production. That includes source audits and discovery, content and pattern mapping, Drupal-native architecture advice, redirects, Canvas and configuration integrity, parity evidence, editorial review, and an explicit boundary between structured Migrate API work and agent-led re-architecture.

Issues such as Canvas configuration data integrity and reconciling updates to already-imported default content are part of this path even though they do not carry an "AI" label.

The standard: given a real source site, when an agent proposes or builds a Drupal replacement, the handoff includes source-site findings, mapped content and patterns, Drupal-native architecture, parity evidence, unresolved gaps, and a clear line where human judgment is required before launch.

Measurement is the spine across all five. The Drupal Agent Readiness Scorecard exists to tell us whether Drupal improved while the workflow held steady - separately from the normal improvement of the models themselves.

Rotterdam should prove direction, not victory

The Rotterdam plan - the proof we are aiming to have ready by DrupalCon Rotterdam - is intentionally narrow: one real rebuild of an existing non-Drupal site into Drupal CMS. The question it answers is precise: can an outside operator turn a real non-Drupal site into a defensible Drupal starting position, with independently reviewable evidence?

• The operator should be outside the Drupal CMS team.
• The source site should contain enough structural complexity to require judgment.
• The result should include a source audit, a governed Drupal build, recorded decisions, independent verification, and explicit gaps.
• A Drupal expert should review it against a predeclared rubric - architecture, permissions, content integrity, editorial usability, maintainability, verification evidence, and known gaps.
• The final question should be binary: would that expert stake their name on this as a sound starting position for a senior team?

The bar we're setting is not, are we "ready to launch.", it is "is this defensible enough to continue?"

One successful build would demonstrate a viable path in that case. A second site with a second operator would begin to test repeatability. Neither would prove that the market has moved - and we should not claim otherwise.

The question then is what remains after the agent is done. A clear test is: give the finished build to a fresh person or agent with none of the original context, and ask them to make a consequential change safely - add an editorial role, alter a workflow without weakening access, explain why the architecture is what it is, recover from a deliberately broken change - while we measure time-to-understand, mistakes, expert intervention, and whether the site's own state carried the reasoning. That tests "decisions as data" far more directly than a second build.

A head start is not a win

Drupal already has much of what builders need for serious sites. Again, that is the good news.

But the bad news is that potential has little value if agents reject Drupal before reaching it.

We should be careful not to declare victory because Drupal has structured content, permissions, workflows, and configuration management - The work that remains is to turn those properties into a clear, measurable advantage: make Drupal easy enough to choose, explicit enough to understand, safe enough to change, and verifiable enough to trust.

Outside AI needs real workflows more than speculative feature lists. If you are using an external agent to build with Drupal, calling Drupal from another system, or encountering friction anywhere from setup through launch, bring us the real task.

A use case, failed run, repeated workaround, missing capability, or existing issue is enough; you do not need to arrive with a solution or even know where the work belongs. Add it to the Outside AI meta issue or bring it to the #ai-initiative channel in Drupal Slack. We will help reproduce it, map it to the agent journey, connect it with the right maintainers and implementation work, and determine whether it belongs in the scorecard.

If you maintain a project agents need to use, tell us what they repeatedly misunderstand or work around. Those workarounds are requirements documents.

Drupal's earned advantage gives us the right to play. What we build, and what we prove next, determines whether we win.

---

Evidence note: the measurements described here are early and deliberately narrow; several are exploratory rather than claim-grade. The scorecard work publishes fixed tasks, retained failures and nulls, explicit evidence boundaries, and paired pre/post results before claiming that Drupal itself improved.