Smart Search, Safe Search How AI & Drupal Work Together

AI search is powerful—but without access control, it can leak private content. This beginner-friendly session introduces RAG (Retrieval-Augmented Generation) and shows how Drupal can sit between users and AI to enforce roles and permissions.

The session will include these topics:
- What AI search and RAG really are
- Why just embedding content in a vector database isn’t enough
- Drupal as truth for permissions
- How to connect Drupal with vector DB and AI
- PoC (How a safe AI search looks like)

Transcript

1. Smart Search, Safe Search🔎 Sachiko Nitta How AI & Drupal Work Together

2. ABOUT ME Drupal Developer Since 2018 Currently Working for Mochiya AI enthusiast Proud Mom of Two Cats🐱🐱 Github: SachikoNitta Drupal.org: sachikonitta Sachiko Nitta
3. THE GOAL OF THE PRESENTATION Build a secure and trustworthy AI search system using Drupal as the source of truth.
4. AGENDA 1. How can we make AI search external content?🤔 2. What is RAG?📚 3. Why Drupal for RAG?😲 4. Let’s Build It🔥 5. Summary👍
5. How can we make AI search external content?🤔
6. The Limitation of LLM They only know what they’ve been trained on.
7. The Limitation of LLM 👶 The capital of France is … Paris LLM
8. The Limitation of LLM 👶 LLM My cat’s name is … ???
9. What if … 👶 LLM My cat’s name is … His name is “Koro”! External Info
10. 3 Ways to Pass Information to LLM RAG 📚 Fine -tuning 🧠 Prompt Engineer -ing ✍
11. What is RAG?📚
12. Basic Flow of RAG 🦱 User App Documents How do I apply for paid leave? 👶 LLM
13. Basic Flow of RAG 🦱 User Chat App Documents 👶 LLM “How to take paid leave like a pro” Let me search for the relevant documents
14. Basic Flow of RAG 🦱 User App Documents 👶 LLM “Please submit a request through the HR system” Please summarize the text
15. Basic Flow of RAG 🦱 User App Documents Oh I see Thank you 🫰 Please submit a request through the HR system 👶 LLM
16. Key Benefits of RAG 001 Up-to-Date and Trusted Information✅ 

17. Key Benefits of RAG 002 Budget Friendly💰

18. Key Benefits of RAG 003 Control and Transparency🤓 

19. Why Drupal for RAG?😲
20. Prompt Injection 🦱 User Apps Data sorce 👶 LLM Data Poisoning Common RAG Security Attacking Techniques
21. Let’s Think About Architecture Like This… 🦱 User Drupal 👶 LLM Data sorce
22. Drupal Prevents Data Leakage Search API + Entity Access Checking 🦱
23. Drupal Prevents Data Corruption Revision Support Access Control Workflow + Moderation
24. This way … AI Search Can Be Secure and Trustworthy󰧤✨
25. Let’s Build It🔥
26. System Overview 🦱 User Drupal Gemini 001 Pinecone Embed Contents & Search Query Store Vectorized Content Gemini 2.5 Flash Summarize the Result
27. Demo: Pillow Street Portal
28. Content Types
29. Product
30. Finance Team Only
31. AI Search
32. How it works for a Finance team member
33. How it works for other employees
34. How to implement this? Configuring AI & Search API Setting up Content types and Access Checking Building Custom Form
35. Setting up Content types and Access Checking
36. Install Modules ✅ AI ✅ Search API ✅ Pinecone Serverless VDB Provider ✅ Gemini Provider
37. Prepare API Keys ✅ Gemini API ✅ Pinecone
38. Prepare API Keys /admin/config/system/keys
39. Gemini Provider Setting /admin/config/ai/providers/gemini
40. Pinecone Setting /admin/config/ai/vdb_providers/pinecone
41. Default Embedding Setting /admin/config/ai/settings
42. Search API Server Setting admin/config/search/search-api/server/[server_id]/edit
43. Search API Server Setting admin/config/search/search-api/server/[server_id]/edit
44. Search API Server Setting admin/config/search/search-api/server/[server_id]/edit
45. Search API Index Setting /admin/config/search/search-api/ind ex/index/fields /admin/config/search/search-api/index/[index_id]/fields
46. Search Form
47. Form /src/Service/SearchApiQueryService.php
48. SearchApiQueryService /src/Service/SearchApiQueryService.php
49. Gemini Service /src/Service/GeminiService.php
50. Search Form
51. Summary👍
52. RAG is a technique that provides additional context to AI models by retrieving relevant external information📝
53. Drupal can serve as a RAG source, effectively acting as the Source of Truth for both content and access control🪨
54. — and this can be implemented easily using existing Drupal modules😎
55. Together, they enable a smarter and safer AI search experience🎊
56. References - AI Module - Search API Module - Structure of routes - What is RAG (Retrieval-Augmented Generation)? - Retrieval-Augmented Generation (RAG) - RAG vs Fine-Tuning vs Prompt Engineering: Optimizing AI Models - Mapping attacks on generative AI to business impact
57. If You Have Any Questions: sachikonitta0731@gmail.com
58. Thank you!