ai_act 1.0.0-alpha1

First alpha release of AI Act: human oversight and traceability for AI operations and agents in Drupal.

Alpha: not for production yet. The module depends on a patch to AI Agents that is still in review, so its API and the module's data model may change. Alpha releases may not provide an upgrade path.

Requirements

• Drupal 11.2 or later
• AI 1.4 or later
• AI Agents 1.4.x with the patch from #3586020 (MR !363). The README explains how to apply it with cweagans/composer-patches.

What's included

• Append-only audit log of AI provider calls and agent runs (AI Act article 12).
• Human approval of agent tool calls: the run pauses before the tool runs and resumes after the decision (article 14), with separation of duties.
• Policies for agent tool calls (require approval, reject, allow) and for chat requests to providers (deny, allow).
• Provenance of the content agents work on, configurable storage of prompts and outputs (full, hash, none).
• Expiry of pending approvals and closing of abandoned runs on cron.
• Review queue and operation pages, Drush commands ai-act:pending, ai-act:approve, ai-act:reject.
• AI Act Automators submodule: runs a supervised agent when an entity is saved.

See the project page for the full list of AI Act articles covered, partially covered and planned.

Known limitations

• The pause for approval works for AI agents only. Other uses of AI are recorded and can be denied by a policy, but cannot wait for a person.
• The Drupal AI chatbot cannot show a pending approval or resume a paused agent yet.
• No configurable log retention yet: the log grows without limit.
• No disclosure or marking of AI-generated content yet (article 50(1) and 50(2)).

Changes

• Initial commit.
• Agent answers are shortened to the maximum length of the target field, instead of being lost when the field is too short.