0:00
Hi, so it's Marcus here to give you a quick update on the 1.4.0 release. It was yesterday.
0:08
Uh I realized while doing this video that my last video was actually about the 1.3 release.
0:14
Um I've been very busy, but I will try to release more videos on things Drupal and AI going forward. And in a steady pattern.
0:23
Uh the 1.4.0 release happens only 2 months after the 1.3.0 release. And I think this will be a common pattern now for the AI module.
0:34
Uh we have reached some maturity. Uh and even if AI changes daily, the underlying infrastructure is quite mature as well. This is also means that this release is more focused on what AI
0:46
module really should be, an underlying framework for others to build really cool stuff on top of.
0:54
So, this will be reflected in this video in comparison to 1.3.0. I will not have as many end-user features.
1:02
Uh last time we were showing a lot of cool field widget actions. What I will show instead is rather how this makes AI ready to be used in enterprises.
1:15
Uh or showing features that requires the contrib module to showcase the full capabilities of this.
1:22
Here we go. We have added global guardrails. I will showcase that. So, say that we are Coca-Cola. We do not want this to happen, that anyone can use our chatbot
1:40
to ask it why Pepsi tastes better than Coca-Cola. Actually, we do not want it to take requests or respond with Pepsi.
1:48
So, I have created a Pepsi guardrail. So, we're just going to clear the history here.
1:54
And we have our Pepsi guardrail uh that is looking for the word Pepsi. In our guardrail sets, there's now global guardrails in 1.4.
2:03
Where we can set which guardrail should always count. So, we just turn this on. Open our assistant and ask this again.
2:12
And all of a sudden, it comes back very quickly. The request contains companies that we are not aligned with. Please re-ask. So, that is a way of using global guardrails.
2:29
Another improvement we're adding in terms of guardrails in 1.4 is to add an input length limit guardrail into AI core, because this is a crucial guardrail that is probably needed everywhere.
2:42
So, the idea behind this is that it stops so-called denial of wallet attacks, which is basically taking something super huge, maybe 500,000 input tokens. You're using Gemini that
2:55
can take 1 million tokens. And they're adding this into a chatbot over and over and over until one of the the following three things happens.
3:06
You run out of uh uh money temporarily, or you hit the rate limit temporarily, or even worse, at the end of the month you get a huge huge bill because someone did this over and over.
3:22
So, the idea is very simple. We're just checking the input length limit and reacting to that.
3:30
So, in this case I've set you can only use 10 tokens. It's using token based counting. In this case, I'm going to go to global guardrails, and you will see it's uh added there. So, I can go to the
3:42
assistant and write say only hello, and this should be three to four tokens, which means that it should answer say "Hello." If I just copy this a couple of times
3:56
because I want to break your input token, you will see that very quickly you get instead, "Your input has 21 tokens, which exceeds the maximum 10 tokens." Of course, you can control this error
4:08
message as you like. Another thing we're adding is the possibility to do guardrails on streams, meaning that a guardrail can define when a string should start buffering, when to
4:24
stop, and what to react to. You might have noticed our latest security update of the AI module where we actually have hardcoded this for links and image attributes in HTML and
4:35
markdown to stop exfiltration attacks using prompt injections. This is the so-called EchoLeak attack.
4:43
Most frameworks are still open for this, but not Drupal. But what we're opening up here is the possibility to use the same method for anything.
4:52
So, in this case, uh we are a car company that has released the MDX 1, MDX 2, and MDX 3.
5:00
And we're about to revolutionize the world with something completely groundbreaking. So, we want to release this as the MDX 250 because it's so revolutionary.
5:12
We do not want journalists to know about this beforehand, but it's really hard to keep track of what editors are uploading into our rag database that is connected
5:20
to our customer chat or journalist chat. So, maybe we have something like this happening. Can you tell me the future MDX version what the future MDX version will be called?
5:31
Someone calls this, and all of a sudden, it streams out, "The future MDX version will be called MDX 450." So, even if we had a guardrail, normal guardrail in this
5:44
case, we had streaming on in the chat bot and then this happened, right? So, what we're going to go ahead and do now is that we're going to enable the mocked up streaming guardrail.
5:57
Uh this one is hardcoded just so you know, what specific guardrail is for this will come in the AI guardrail module and in the AI 1.5.0 release.
6:07
So, now we try the same thing and it's going to stream out. The future MDX version will be called MDX redacted.
6:15
So, we have gone ahead and redacted it. These are streamable guardrails. In 1.4, we are also starting to improve the guardrails so you can set specific guardrails for specific framework
6:32
processes. We're also going to add in AI agent 1.3 that you can set specific guardrails for specific agents.
6:41
But, what we're adding in 1.4 of AI module is that you can do it for the automators. So, if I have automator, in this case, I just have a summarizer of the body field, for instance. If I go
6:53
down to advanced settings and at the bottom, we have guardrail set. So, you can set any guardrail specifically or guardrail set specifically to any any automator. This means that you can
7:07
have a specific guardrail and then also a global guardrail and both of those will run for the specific automator.
7:20
Another issue that we're adding in 1.4 that might look minor if you read the issue is that we're moving exceptions into event and making sure that that event also can give back a chat output
7:35
that can happen deterministically, programmatically, via another LLM, and so on. This opens up to what you're seeing here, which is that we can make ECA take over
7:47
the whole lifespan of a request and a response. This means that we can handle failover, rerouting, guardrails, basically whatever we want to do there via ECA. I'm going to give three example
8:02
of how this can be useful, but that of course does not cover the whole thing. This will be in the AI ECA module. So, in this case we get the OpenAI GPT-5.2 call in.
8:14
It checks if this has complex tools. Then we know that Claude Opus just works with this better. So, it reroutes it to Claude Opus.
8:23
If it doesn't have complex tools, we count the request tokens. And if the input request tokens is under 300 tokens, well, we probably don't have to pay GPT-5.2, which is still a pretty
8:37
complex model. And we reroute this to Gemini 1.5 instead. So, uh these are specific actions and conditionals that we have added uh into the AI ECA module.
8:52
Take another uh event here. The response has failed and it's OpenAI for chat. Well, if it fails, we just use Claude Sonnet 4.5 instead.
9:04
This means that in this case we don't care why it failed. You can actually have conditional what the actual exception is here.
9:13
Uh uh because depending on the exception, you might want to do different things of course. So, one fairly complex thing you can do here is that you could for instance
9:26
check something we added in 1.3. What are my rate limits and when do they reset? The rate limits will reset in 10 seconds.
9:35
Okay, then we wait 10 seconds before we try again. So, you could do something like that.
9:41
In this case, we basically create that guardrail using ECA. So, we get the provider response back and we're basically checking contains feature model name. In this case, we I just made
9:52
something up, MDX 450. And if it contains MDX 450, it's not going to give back that provider response. Instead, it's going to give back, "I'm sorry, Dave. I'm afraid I
10:03
can't do that." So, we can actually control the response as well. In 1.4, we are also adding so-called agentic skills. And this means that if you're using Claude Code, Codex, Open
10:22
Code, something like this, it's going to come with a lot of skills. So, either you can use the AI best practices module to utilize the skills, or you can use npx skills and just point it at the
10:34
version of the Git repo, and you will see, all of a sudden, in this case, that you can get six different skills. And all these skills are either because you want to extend the AI module, you want
10:46
to create your own either contrib AI provider, or maybe you have a private AI provider, or you want to help out with AI module, create a functional JavaScript uh test,
10:57
for instance. These will install the skills into wherever you have started these commands.
11:05
And if you run your Claude agent or your Codex Agent or whatever you're using, you can just use skills, and they're going to use the best practices to create these different parts. Now, if
11:17
you, for whatever reason, don't want to use the uh agentic way of developing, you're old-fashioned, you want to write your own code, these are built on top of generating
11:28
code using the Drush generate. So, we have also added this. So, you can use the drush generate to generate automated type or guardrail or a provider. So, basically uh
11:41
getting some skeleton code into your repo. I will create a video later going into how to utilize the skills where I will showcase how we can uh go from zero to create operation type
11:55
and create a new AI provider around this create a API explorer around this and so on. But, this will happen in another In 1.4.0, we are introducing the chat processor
12:12
interface. It is a contract between a processor, which usually will be an agent, but could be something custom, and a conversational UI.
12:23
Something we saw earlier on is that one size of conversational interfaces does not fit all.
12:29
Say that you have a website that creates multiple surveys per week, and that is something you want an external partner to do, but you do not necessarily want them to learn how to use your Drupal
12:40
website. Well, here's one example of a chatbot that that might help you with that.
12:47
This is the Slack AI module that exposes a chat processor for Slack. So, just another version of a chat, and sets up a bot user to be connected with an agent on the Drupal website.
13:01
Here, you can see the current web forms that are available on the website. I will just go ahead and ask it here to create a web form about accessibility for me, but be specific that I want it
13:14
to give suggestions before it goes ahead and does it. You will see it has replaced replied to me here what it's going to go ahead and do. I do this to showcase the
13:24
possibilities, but more importantly, uh show that you can hold conversations and memories with anything.
13:34
I will ask it to go ahead now, and hopefully it will go ahead now and create this then. And this means that we open up the chatbot UI UI X space for country modules. They can move faster,
13:47
have more releases, and adapt to how fast AI is evolving. You can create one chatbot that is for the editors on the website, and a completely other chatbot that is
14:00
performant and for the end users, for instance. This also means that we can create a module for the naive rag solutions that many users have asked for.
14:11
So, non-agentic chat to find your content that is cheaper, maybe not as smart, but cheaper for the end user.
14:21
Another idea is to add an ECA processor that makes it possible to use something like Slack as a terminal command with commands you set up in ECA.
14:30
If we now go back to the web form because we see it has answered here, right? And reload, you will see that our web form has been created. If we click on it, you will see that it was
14:43
created as written. This is the chat processor interface. So, going back to the automators, there's a small minor nifty thing that makes a big big difference for what we
15:01
can do with automators. So, if we go to our summarize automator, uh as you know, we can set it so it gets saved directly. We can set it so it uh sorry, it's processed when we save
15:15
it directly. When it runs on cron, there's a ECA module you can solve, so it's part of ECA.
15:22
You can have it in the batch API, or you can just field widget actions. Uh there's a post processor module that you can run if you want to use it in API, as well. But, what's part of AI 1.4
15:34
is that you can make it into an action. And this makes sure that it doesn't run during entity save, but an action you can, of course, uh wrap in something like views bulk operation.
15:45
Which means that all of a sudden you can have something like a alt text. Say that you haven't set alt text on over 1,000 entities or something. You can, all of a
15:57
sudden, set up a alt text automator, choose the action, and then use views bulk actions to just rerun those thousand in a simple way.
