drupal / varbase_ai_safety

1.0.1 2026-10-24 18:02 UTC

Requires

• drupal/ai: ~1
• drupal/ai_recipe_guardrails_pii: ~1
• drupal/ai_recipe_guardrails_prompt_safety: ~1
• drupal/ai_validations: ~1.4
• drupal/core: ~11.4.0
• drupal/field_validation: ~3.0

GPL-2.0-or-later

• Vardot

• ai
• recipe
• pii
• drupal recipes
• drupal recipe
• Varbase recipes
• varbase recipe
• Drupal AI
• field validation
• Varbase AI
• AI Safety
• AI Guardrails
• Prompt Safety
• AI Logging
• AI Observability
• Image Safety
• AI Validations

Published on Packagist.org on 2026-10-24 18:22 UTC

README

Varbase AI Safety

A recipe to bundle a complete AI safety stack for Varbase — guardrails, logging, and observability.

This recipe provides a defense-in-depth AI safety setup including:

• Drupal AI module (ai)
• AI Logging (ai_logging) with 90-day retention enabled by default
• AI Observability (ai_observability) for transparency and compliance reporting
• 14 guardrail rules across 3 sets, configured against restrict_to_topic and regexp_guardrail plugins
• Image safety: images uploaded to the Image media type are checked by the site's vision model and refused when they are not suitable for a general audience (field_validation and ai_validations)

Requirement: a default model for Chat with Image Vision (/admin/config/ai/settings). The recipe stops before it changes anything when none is set: without one, every image upload would be refused.

Sub-Recipes Applied

This recipe chains the following upstream recipes via the recipes: key:

• drupal/ai_recipe_guardrails_prompt_safety — Prompt Safety: Liability set + Prompt Safety: Security set
• drupal/ai_recipe_guardrails_pii — PII Protection set

Included Guardrail Sets

Prompt Safety: Liability (prompt_safety_liability)

Blocks topics that carry legal or reputational risk for the site owner.

• Liability: Legal Advice
• Liability: Medical Advice
• Liability: Sensitive Topics

Prompt Safety: Security (prompt_safety_security)

Blocks structurally malicious input and semantic prompt attacks (XSS, HTML/CSS/JavaScript injection, prompt manipulation/jailbreak detection).

• Security: CSS Expression Injection
• Security: Dangerous HTML Tags
• Security: HTML Event Handler Injection
• Security: JavaScript Execution Functions
• Security: JavaScript Protocol
• Security: Prompt Manipulation
• Security: Script Tag Injection

PII Protection (pii_protection)

Detects and blocks personally identifiable information (PII) in both user input and AI output. Baseline GDPR / data-protection coverage.

• PII: Credit Card Number
• PII: Email Address
• PII: IBAN
• PII: Phone Number

Image Safety

Every image uploaded to the Image media type, from the media add form or the media library, is sent to the site's default vision model and refused when it is not suitable for a general audience: nudity, sexually suggestive content, gore, graphic violence or graphic medical imagery. The editor sees why it was refused.

• One Field Validation rule set, AI image safety (Media: Image), with an AI Validations rule on field_media_image, for every role. Edit the prompt or the message at /admin/structure/field_validation.
• It fails closed: when the provider errors or the model is removed later, uploads are refused until it is back.
• Applying the recipe again leaves an edited rule set as it is.

AI Logging Settings Applied

• prompt_logging: true (automatic logging enabled)
• prompt_logging_max_age: 90 days (older entries auto-deleted)
• prompt_logging_max_messages: 1000

Compatible With

• Drupal core ~11.3.0
• Varbase
• drupal/ai ~1
• drupal/ai_recipe_guardrails_prompt_safety ~1
• drupal/ai_recipe_guardrails_pii ~1
• drupal/field_validation ~3.0
• drupal/ai_validations ~1.4

Apply the Recipe

Add the recipe using composer:

composer require drupal/varbase_ai_safety:~1.0.0

Change directory to /web or /docroot

Run the Drupal recipe bash script:

bash core/scripts/drupal recipe recipes/contrib/varbase_ai_safety

or

Run the Drush recipe command:

drush recipe recipes/contrib/varbase_ai_safety

or

Apply via the Project Browser UI at /admin/modules/browse/varbase_recipes → click Install on Varbase AI Safety.

Why This Matters for Varbase Enterprise Clients

Varbase targets enterprise Drupal deployments. Enterprise clients require:

• Compliance evidence — ai_logging + ai_observability provide the audit trail.
• PII protection — GDPR requirement for EU clients.
• Liability control — legal teams need assurance AI won't generate legal/medical advice.
• Security hardening — prevents AI-assisted XSS via content injection vectors.