AI Recipe: Validations Image Safety

Validates uploaded images on the Media: Image bundle using a vision-capable AI provider. Blocks content that falls outside the "Safe" tier of Flickr-style safety
levels — nudity, sexually suggestive material, gore, graphic violence, and graphic medical imagery — at upload time, across the admin UI, JSON:API, and programmatic
saves.

Recipes Applied

• core/recipes/image_media_type

Modules and Themes Installed

• AI (Artificial Intelligence)
• AI Validations
• Field Validation

Requirements

• Drupal 10.5 or newer
• AI module 1.4 or newer (provides the verifySetupAi config action)
• AI Validations 1.3 or newer
• Field Validation 3.0 or newer
• A configured default provider for the chat_with_image_vision operation type at /admin/config/ai/settings → Default Providers. Any vision-capable provider works (OpenAI GPT-4o, Anthropic Claude 3.5 Sonnet, Google
  Gemini 1.5 Pro, etc.).

Installation

Field Validation 3.0 currently has beta releases only, so projects using the default minimum-stability: stable must allow it
explicitly before requiring the recipe (Composer stability flags only count in the root project during resolution — the recipe declares ^3.0@beta so the flag is preserved in your root composer.json when the recipe is unpacked, but the
initial install still needs the command below). This first command becomes unnecessary once Field Validation tags a stable 3.0.0 release:

  composer require drupal/field_validation:^3.0@beta

On a site that already has a vision provider configured

If a default model is already set for the chat_with_image_vision operation type, this is all you need:

  composer require drupal/ai_recipe_validations_image_safety
  drush recipe ../recipes/ai_recipe_validations_image_safety
  drush cache:rebuild

On a brand new site (AI not configured yet)

The recipe's preflight check requires a default model for chat_with_image_vision, and configuring one requires the AI module and
a provider module to be installed and set up — so do that first. The recipe does not install a provider for you, because that choice is yours:

  composer require drupal/ai_provider_openai drupal/ai_recipe_validations_image_safety
  drush en ai ai_provider_openai key -y

(Substitute ai_provider_openai with the provider module of your choice — ai_provider_anthropic, ai_provider_google_gemini, etc.)

Then, in the admin UI:

1. Add your API key at /admin/config/system/keys.
2. Configure the provider at /admin/config/ai/providers.
3. Set a default model for the chat_with_image_vision operation type at /admin/config/ai/settings → Default Providers.

Finally, apply the recipe:

  drush recipe ../recipes/ai_recipe_validations_image_safety
  drush cache:rebuild

Recovering from a failed apply

If the apply aborts with "The operation type 'chat_with_image_vision' does not have a default model", your site was rolled back to its pre-apply state —
modules reported as installed earlier in the output were reverted as part of the rollback. Recipe application is atomic, and on a site without a configured provider
the preflight cannot pass, because configuring a default model itself requires the AI module. Follow the brand-new-site steps above, then re-run the apply.

What it does

• Creates a Field Validation rule set on the Media: Image bundle's field_media_image field.
• Runs the AI image constraint on every image upload, classifying the image into Safe / Moderate / Restricted tiers.
• Blocks anything outside the Safe tier with a clear error message to the editor.
• Catches uploads from the admin UI, the Media Library, JSON:API posts, migrations, and programmatic $entity->save()
  calls.

Adjusting the threshold

The default behavior blocks both Moderate and Restricted content. To allow Moderate content (mature but not explicit) and block only Restricted (explicit /
graphic), edit the ai_image_safety rule at Structure → Field Validation → AI image safety (Media: Image) and
update the prompt's decision block. Full instructions are in the project README.

Cost note

Every image upload triggers one vision-model API call. Bulk migrations, imports, or high-volume user upload flows will incur proportional cost. Test with your
provider's pricing before rolling out to production.

Bugs and Feedback

If you encounter any bugs or have feedback about this recipe, please file an issue in the href="https://www.drupal.org/project/issues/ai_recipe_validations_image_safety">project issue queue.

Credits

Developed as part of the AI Initiative. See the originating issue: href="https://www.drupal.org/project/ai_initiative/issues/3585696">#3585696.