Refuse uploaded images unsuitable for a general audience with an AI image safety check

Problem/Motivation

This recipe bundles prompt safety, PII protection, logging and observability, but nothing checks the images editors upload. An image not suitable for a general audience (nudity, sexually suggestive content, gore, graphic violence, graphic medical imagery) can be uploaded to the Image media type and published.

Proposed resolution

Add Image Safety to this recipe:

• Install Field Validation (drupal/field_validation ~3.0) and AI Validations (drupal/ai_validations ~1.4), with file, image and media.
• Create one Field Validation rule set, "AI image safety (Media: Image)", with an AI Validations image rule on media.image.field_media_image for every role. Its prompt classifies the image (safe, moderate, restricted) and refuses anything but safe, with a clear message to the editor.
• Before changing anything, a verifySetupAi config action checks that a default model is set for Chat with Image Vision, and stops the apply when none is. Without one every upload would be refused.
• It fails closed: if the provider errors or the model is removed later, uploads are refused.
• strict: false and createIfNotExists, so re-applying is safe and leaves an edited rule set alone. The image field is saved once so its cached definition picks up the rule at once.
• README (the requirement and an "Image Safety" section) and CHANGELOG updated.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Test on a Varbase 11 site with and without a default vision model
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ❌ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• An image upload that is not safe is refused with the safety message.
• The rule set is editable at /admin/structure/field_validation.

API changes

• None.

Data model changes

• New config field_validation.rule_set.media_image.
• Two new module requirements.
• Applying now needs a default model for Chat with Image Vision.

Release notes snippet

• Varbase AI Safety now refuses uploaded images that are not suitable for a general audience, checked by the site's default vision model. Applying it needs a default model for Chat with Image Vision.

AI-Generated: Yes