Fast Code, Faster Debt: Why Eduardo Telaya Built AI Code Guardrails

There is a particular kind of frustration that comes not from failure but from repetition. Eduardo Telaya, the creator of AI Code Guardrails, knows that feeling well. It did not come from a single bad project or a difficult client. It came from code reviews, night after night, month after month, where the same problems kept showing up with remarkable consistency.

The project was originally published under a different name and has since been renamed AI Code Guardrails following concerns about potential confusion within the Drupal ecosystem. The update clarifies the project’s scope and distinguishes it from other initiatives.

⚠️ Clarification: This project should not be confused with the broader Drupal AI initiative, which provides modules and integrations for adding AI capabilities to Drupal sites. AI Code Guardrails is a separate developer-focused toolkit composed of structured knowledge files, rules, and agents. It is not a traditional Drupal module and is not part of the official initiative.

"I reviewed 47 PRs in a month," Eduardo recalls. "38 had the same issues: \Drupal::service() inside classes, no cache tags, hooks ignoring Drupal 11's #[Hook] attribute. Different developers. Different projects. Same AI. Same errors."

The developers were not careless. They were doing what developers across the industry were doing: using AI coding agents to move faster. Claude, Codex, and similar tools had become a normal part of the workflow. The problem was that the AI they were using did not understand Drupal well enough. It had been trained on older patterns, outdated documentation, and codebases that had not caught up with Drupal 11. So it kept reproducing the same anti-patterns, confidently and at speed.

For a while, Eduardo kept correcting the same things in the same reviews. Then, at some point, the pattern became impossible to ignore.

"That's when I realized: the AI wasn't broken. It just didn't understand Drupal well enough. The real problem was the missing layer between AI and developers."

That missing layer is what AI Code Guardrails was built to be.

Before building anything, Eduardo looked at what already existed in the community. There were a few efforts worth taking seriously. One was an expansive skill set with genuine depth and thoughtfulness behind it. Another showed exactly the right instinct in terms of structure but had not been kept up to date as Drupal evolved. Both were pointing in the right direction. Neither was sufficient for production use.

"Looking at other efforts like Drupal at your fingertips and the drupal-expert skill, I actually felt inspired. They showed that people are already trying to solve this. But they also made something clear: prompts alone don't solve the problem. They help, but they don't give consistency. What's missing is structure—rules, patterns, and standards that guide how AI should work with Drupal, not just what it outputs."

The size problem was also real. A skill that consumes a large portion of a model's context window on every invocation is not sustainable across a real project. You end up paying for context you do not need, and the agent slows under the weight of it. What was needed instead were small, focused skills that loaded only when relevant.

So Eduardo started building. The first version, by his own account, was entirely personal. He wanted to stop leaving the same review comments every night. But as he worked, he went deeper into the problem itself, thinking about how large language models infer patterns and generate code, and how that process could be guided more deliberately.

He built skills first. More than thirty of them, each covering a specific domain: dependency injection, caching, security, the entity API, hooks, migrations, Twig templating, testing, routing, and database queries. Each skill was kept deliberately small so it could be loaded on demand. Each came with a README written for humans, explaining not just what the skill does but when and why to use it.

Then came the rules. Where skills tell an agent what to know, rules tell it how to behave. These are non-negotiable constraints applied automatically to every task: prefer dependency injection over static service calls, use the phpcs.xml file as the source of truth, avoid SQL concatenation, and document hook implementations correctly.

Commands followed, automating parts of the development workflow, including pull request reviews and task coordination. Support for multiple AI tools, including Codex, was later added to ensure portability across environments.

The result is a toolkit of skills, agents, rules, and hooks that operates as a knowledge layer for AI coding agents rather than as a Drupal module itself.

The project page also notes that it is not covered by Drupal’s security advisory policy and should be used with caution. It operates outside Drupal core and is intended as a supporting layer for AI-driven development workflows.

The moment it was used internally, the impact was immediate. Repeated mistakes stopped appearing, and code quality became more consistent across teams. That is when Eduardo decided to open-source it.

"What I saw in those PR reviews is exactly how tech debt starts with AI. Teams feel faster at the beginning, but they're actually introducing the same mistakes at scale. AI doesn't remove responsibility—it amplifies it."

His longer-term vision extends beyond code review. He describes a future where AI agents can build complete Drupal sites while still following best practices, supported by shared standards across the community.

AI Code Guardrails represents an attempt to define that structure. It is not the final solution, but a step toward making AI-assisted Drupal development more consistent, scalable, and reliable.

Editor’s note: This article was temporarily unpublished following naming concerns raised within the Drupal community. It has been updated to reflect the project’s new name and clarify its scope.