Drupal AI Initiative Sets Inside and Outside AI Priorities

Two Drupal AI Initiative posts published on 23 July 2026 set separate priorities for AI features used inside Drupal and external agents acting on Drupal. Christoph Breidert, product lead for Inside AI, described plans to combine several features in “Inside AI is building what our partners asked for”. Scott Falconer, product lead for Outside AI, outlined a roadmap for agent access, governed action, and verification in “Outside AI - The State of Agent Experience in Drupal”. Both posts are initiative-authored updates, so their rankings and measurements should be read as roadmap evidence rather than independent validation.

The distinction matters because each workflow reaches Drupal through a different interface, but both rely on many of the same controls. Inside AI focuses on assistants and workflows presented to people using Drupal, while Outside AI covers agents and builder tools operating from another system. The initiative says shared capabilities should be contributed once where possible, including context, identity, tool declaration, permissions, governance, security, observability, and verification. The common test is whether AI-assisted changes remain understandable, authorised, and reviewable regardless of where they begin.

Inside AI is assembling AI Search, a chatbot, content review, and translation, with observability and security beneath those features. Christoph reports that organisations funding and staffing the initiative ranked AI Search first, followed by content review, translation, chat-driven editing, and bulk content updates. The post does not provide a respondent count, scoring method, or underlying results, so the ranking remains the initiative’s account of partner priorities. The team plans to show the combined features on one multilingual site at DrupalCon Rotterdam, scheduled for 28 September–1 October 2026.

The Inside AI update frames integration and repeatability as the immediate delivery problem. Several capabilities already work separately, but the team still needs recipes, configuration, realistic content, prompt tuning, and consistent end-to-end results before presenting them together. Dedicated leads have been named for the demonstration, search, translation, Canvas AI, and context, while content review, the chatbot, observability, and security roles remain open. The post does not set release versions or production-readiness criteria for the combined demonstration.

Outside AI begins with the journey an external agent must complete before it can make a dependable change to a Drupal site. Scott reports that agents completed a narrow first-hour task on Drupal CMS, Drupal core, WordPress, and a Node application, with additional spot checks on Wagtail, Joomla, Strapi, and Payload. The task required structured content, seeded content, a public page, and a scoped editor role, with milestones checked through independent HTTP requests. The evidence remains early and deliberately narrow and does not establish a general performance advantage for Drupal.

The Outside AI roadmap groups the remaining work into five stages: starting and connecting, understanding a running site, acting through governed interfaces, verifying and recovering changes, and rebuilding or launching through a repeatable process. It calls for scoped execution identities, discoverable actions, predictable authorisation, structured receipts, independent checks, and recovery paths. For DrupalCon Rotterdam, the team proposes testing the final stage through one rebuild of an existing non-Drupal site. The post says one successful rebuild would demonstrate a viable path in that case, not production readiness, repeatability, or wider adoption.

Drupal 11.4 provides part of this technical foundation through an experimental extensible command-line interface at vendor/bin/dr. The contributed MCP Server module documents command-line and HTTP transports, Tool API integration, configuration-managed tools, and OAuth 2.1 controls with per-tool scopes. As of 27 July 2026, its project page lists 2.0.0-alpha1 and says no supported stable release is available. These components address parts of the connection and governed-action layers but do not yet meet the wider requirements described by Scott for consistent authorisation, receipts, independent verification, and recovery.

The updates turn the Inside and Outside distinction into defined areas of delivery and measurement. Inside AI concentrates on feature integration and demonstration quality, while Outside AI concentrates on agent entry, governed actions, verification, and handoff. The plans do not establish production readiness or market adoption, but they place Drupal’s permissions, structured configuration, and review workflows at the centre of both human-facing assistance and external agent operations.