Lucas Cunico Kalinowski Flags Silent Drupal Contracts in AI-Assisted Code

Code generated with AI can pass conventional checks while still omitting information Drupal needs to handle access, caching, or configuration as intended, senior software engineer Lucas Cunico Kalinowski argues in a LinkedIn article published on 25 August 2026. Coding agents learn from errors. Drupal's worst bugs do not produce one. opens with a permission check that returns the expected access result but omits the cache context Drupal core adds through AccessResult::allowedIfHasPermission(). That distinction matters because Drupal merges an access result's cacheability metadata into the render array, allowing permission-dependent output to vary by the appropriate cache context.

Lucas uses the access example to identify a wider class of Drupal mistakes that may not produce a failed build, application error, or unsuccessful request. His examples include a component with max-age set to zero preventing a larger render tree from being cached, listings that need entity list cache tags to respond when new content is created, and configuration synchronisation treating active configuration absent from the synchronisation source as a deletion. He argues that conventional verification can miss these cases when tests check an immediate result without exercising later cache variation, invalidation, or deployment behaviour.

Lucas does not argue against coding agents and says he uses one regularly. Instead, he recommends concentrating human review on places where Drupal expects developers to declare cacheability, access, or lifecycle information and can otherwise continue without producing an explicit error. He demonstrates the caching side of that argument through his browser-based Drupal Cache Playground, which he says models behaviour from Drupal 11.3 core. Readers can examine the complete examples and core references in Kalinowski's original LinkedIn article.