Lucas Hedding Outlines AI-Assisted Proposal for Drupal Core Authentication

Contributors can now review a proposed architecture for a new authentication system in Drupal core. In a blog post published by Tag1 Consulting on 15 July 2026, Lucas Hedding, Drupal core authentication and authorization subsystem maintainer, said he used Claude to process more than 1,200 open issues connected to the subsystem and help shape the proposal. The design is documented in a planning issue for a YAML-based pluggable authentication flow, with phases and dependencies identified but no implementation code written.

The plan proposes YAML-discovered authentication flows composed of ordered step plugins, with separate handling for interactive and transparent authentication. It also defines requirements for session and context handling, default username-password and basic-auth flows, REST route integration, and an opt-in migration phase that would initially leave AuthenticationProviderInterface unchanged. Hedding describes using artificial intelligence to collect and cache Drupal.org issue data, map relationships between authentication issues, compare reference frameworks through BMAD, and incorporate questions raised during Drupal community discussions into the design. The proposal remains at the design-review stage, giving core contributors an architecture to evaluate before implementation work begins.