From the “Light Factory” to Your CMS: Why AI Governance and Orchestration Are Your Company's Next Strategic Asset

AI governance with Drupal is emerging as one of the key strategic opportunities for organizations looking to adopt artificial intelligence without losing control of their data, permissions, and business processes.

A conversation is emerging at the intersection of two worlds that rarely talk to each other: autonomous AI agents and enterprise content platforms. And the thesis taking shape should interest any organization evaluating how to adopt artificial intelligence without losing control of its operation.

In July 2026, Thomas Scola — founder of Bluefly.io, Acquia veteran, and one of the most respected voices in the Drupal community — published an essay titled Drupal CMS and the Rise of the Light Factory.¹ His argument connects Steve Yegge's recent work on multi-agent systems with twenty-five years of Drupal architecture, and arrives at a provocative conclusion: the platform many still see as "just a CMS" could become one of the governance foundations of the AI era.

At Seed EM we have long argued that digital properties are business assets, not marketing expenses. This essay adds the missing piece: the most valuable asset inside that digital property is organizational context — and the ability to govern it.

One clarification up front: this is an emerging thesis — a community leader's reading of where the industry is heading, not an empirical study. But it is exactly the kind of thesis worth understanding before it becomes consensus — and, as we will see, Drupal's official roadmap is already turning it into product.

Dark Factory vs. Light Factory: The Metaphor That Frames the Discussion

The concept that gives the essay its title comes from Steve Yegge² and describes two opposite ways of bringing autonomous systems into an organization.

A Dark Factory is software doing work somewhere in the background: no monitoring, no constraints, no visibility. It is what happens when a company plugs AI agents into its systems and trusts them to "do their thing." It works — until someone has to explain why the system made a decision, in front of a customer, an auditor, or a regulator.

A Light Factory starts from the opposite principle: if software is going to make decisions on the organization's behalf, every decision must be visible, every action observable, every handoff understandable. And most importantly: governance is not a layer added later — it is part of the architecture from day one.

Any leader who has lived through an audit, a reputation crisis, or a data incident immediately recognizes which of the two models they want in their company.

The Unexpected Turn: Drupal Has Spent 25 Years Building the Light Factory

Here is Thomas Scola's central observation, and the reason the essay circulated quickly through the community: the problems that define AI agent governance — identity, permissions, workflows, traceability, structured data — are exactly the problems Drupal has been solving for decades.

The Drupal community doesn't talk about "agent orchestration." It talks about workflows, granular permissions, configuration management, revision history, content moderation, and APIs. Topics that never headline a keynote, but which are the reason governments, universities, and Fortune 500 companies trust the platform with their most sensitive operations.

Translated to the agent era, those "boring topics" become the critical questions of enterprise AI adoption:

• Who (or what) is doing the work? Drupal's identity and permission system answers this natively — and applies equally to a human editor and an AI agent.
• Under what authority can it act? Granular permissions and approval workflows define what each actor, human or automated, may do and what requires review.
• Why was this decision made six months ago? Revision history and audit logs make decisions explainable long after they were executed — the core requirement of any AI audit.
• How do different systems collaborate without hidden assumptions? API-first architecture and structured data act as explicit contracts between systems.

The ecosystem is already materializing this vision: initiatives like AI Core, AI Context, Tool API, Modeler API, MCP integrations, ECA, and Canvas are not isolated innovations, but pieces of a platform that doesn't just integrate AI — it governs it.

"Models Will Become Commodities; Context Will Become Strategy"

The essay's most quoted line condenses the thesis: AI models are becoming interchangeable, and competitive advantage is shifting toward the platforms that help organizations own, govern, and continuously enrich their context.

Think of it in practical terms. Today any competitor can access the same language model you can. What they cannot replicate is your context: your brand voice, your business rules, your product taxonomy, your approval workflows, your organization's decision history. That context is what turns a generic AI into an AI that works for your company.

And here appears the strategic decision many organizations are making without realizing it: when the entire AI operation lives inside closed proprietary platforms, that context — the differentiating asset — is handed over to the vendor. Thomas Scola frames it as the defining choice: platforms where the organization retains ownership of its context, versus platforms it surrenders it to.

This is the natural extension of the argument we developed in the previous entry of this series: if digital properties are business assets, the context they contain is the component of that asset with the greatest potential for appreciation — or for loss, if it ends up trapped in a system the company doesn't control.

From Governance Platform to AI Orchestrator: The Thesis Becomes the Roadmap

If Thomas Scola's essay described where Drupal's architecture points, the project's own announcements over the past year confirm that direction is now official strategy. In the most recent Driesnote, Dries Buytaert introduced the vision the community has labeled DXP 2.0:³ Drupal ceases to be understood as a content repository and is repositioned as the organization's central hub for business logic — the point where content, workflows, AI agents, and external systems converge.

This is not an aspirational slide. It rests on concrete pieces already in production:

1. A unified framework for AI models. Drupal's AI module connects a site to more than 48 AI platforms — OpenAI, Anthropic, Gemini, Mistral, local models via Ollama — under a single abstraction layer. The strategic consequence is exactly what Scola anticipated: the model becomes interchangeable; what remains is the context you govern. If a provider changes its pricing, data policy, or quality tomorrow, the organization swaps models without rebuilding its operation.
2. Agents that act inside the governance perimeter. The AI Agents framework — now stable and backed by the Drupal AI Initiative, which passed the one-million-dollar funding milestone⁴ — enables text-to-action agents: agents that create content types, edit fields, or execute configuration changes from natural-language instructions. The critical difference versus a generic agent operating "in the dark" across your business is that these agents act inside Drupal's permission system, workflows, and revision history. Every action is attributable, reversible, and auditable. It is the Light Factory in its most literal form: automation with the lights on.
3. Internal and external orchestration. Inward, the ECA (Event–Condition–Action)⁵ module lets teams model complex workflows without code: which event triggers which agent, under which conditions, with which human approvals in between. Outward, the new stable Orchestration module exposes Drupal's capabilities — including its AI agents — to external automation platforms through a unified API. Drupal no longer merely governs your context: it makes it available to the rest of the enterprise stack on its own terms.
4. Context as a service: Drupal as an MCP server. Perhaps the most revealing piece is the Model Context Protocol (MCP) module, which turns Drupal into a context server for language models. Any authorized LLM can dynamically query the business data living in Drupal — with the permissions, traceability, and structure the platform already enforces. "Own your context" stops being a slogan and becomes an interface.

One additional technical detail deserves the attention of any architecture team: the AI module's evolution is adopting Symfony AI as its unified abstraction layer. For organizations operating on the PHP/Symfony ecosystem — which includes both Drupal and DXP platforms like Ibexa DXP — this means the investment in AI orchestration is not locked inside a single product: it rests on the framework underpinning a significant share of the enterprise web.

The most recent signal arrived in July 2026: the maintainers of the ecosystem's three major automation tools — Jürgen Haas (ECA), Randy Kolenko (Maestro), and Shibin Das (FlowDrop) — formed the Drupal Orchestration Initiative⁶ together with Dries Buytaert, a shared design effort defining common primitives (triggers, steps, workflows, runs) and data contracts so workflows can flow between tools, agents, and external systems without leaving Drupal's permission and audit perimeter. Three specialized tools, one shared direction: orchestration as a native platform capability, not an external service you surrender control to.

The synthesis is direct: governance is the precondition; orchestration is the function. An AI orchestrator without native governance is a Dark Factory with better marketing. Drupal inverts the order: first, twenty-five years of permissions, workflows, and auditability — and on that foundation, now, the ability to direct agents, models, and automations. This is not about plugging AI into your CMS. It is about your content platform becoming the control tower from which your organization operates AI.

AI Governance with Drupal: What It Means for an Organization Evaluating AI

The AI governance conversation tends to sound distant — something for European regulators and global banks. It isn't. These are the concrete implications for any company bringing AI into its digital operation:

1. The buying question changes. It is no longer "which AI model do we use?" but "where does our context live and who controls it?". A SaaS chatbot that learns from your data but won't let you export that learning is a Dark Factory with a nice interface.
2. The CMS stops being a publishing system and becomes the governance and orchestration layer. If your content platform — like Drupal —already manages identities, permissions, workflows, and audit trails, extending it to govern and orchestrate AI agents is evolution; replacing it with a proprietary black box is regression.
3. Open source stops being a technical preference and becomes a strategic stance. As Drupal creator Dries Buytaert points out,⁷ open projects don't just produce software: they generate the knowledge and architecture that intelligent systems learn from. Building on open standards (like the OSSA specification Scola himself proposes for defining agents) protects against lock-in at the moment of greatest technological uncertainty in decades.
4. AI audits will arrive sooner than they appear. AI regulation is advancing in every jurisdiction. When the requirement comes to explain how an automated system made a decision, organizations with Light Factory architecture — backed by Drupal's revision history and granular permissions — will have the answer in their revision history. The rest will have a problem.

Our Reading: The Trilogy Comes Full Circle

This series began with McKinsey predicting in 2007 that the CMO would lead business transformation. It continued with TalentoHC confirming in 2026 that digital properties are balance-sheet assets. Thomas Scola's essay delivers the third act: the value of that digital property no longer lies only in the experience it delivers, but in the context it governs — and in the agents it orchestrates on top of it.

A well-architected corporate site on Drupal is no longer merely the channel where your brand meets the world. It is the structured repository of your organizational knowledge, the permission system defining who and what may act on your behalf, and — increasingly — the AI governance and orchestration layer on which your agents will operate visibly, auditably, and under control.

Organizations that understand this early won't just have better websites. They will have the trust infrastructure on which their next decade of digital operation will be built.

Frequently Asked Questions

What is AI governance?

It is the set of architectures, controls, and processes that make artificial-intelligence systems operate visibly, auditably, and under defined authority: who or what may act, with which permissions, and how each decision can be explained months or years later. In a well-designed architecture, governance is part of the system from day one, not a layer bolted on afterward.

What is AI orchestration?

It's the active coordination of models, autonomous agents, and workflows to execute business processes: which agent acts, at what point, under what conditions, and how work is handed off between systems without losing traceability. While governance defines the limits and authority, orchestration is the layer that puts those elements into motion — within the same permissions and audit perimeter that governance already established.

What does "Light Factory" mean in enterprise AI?

It is a concept coined by Steve Yegge and applied to Drupal by Thomas Scola. A "Dark Factory" is autonomous software working without monitoring or constraints; a "Light Factory" is a system where every automated decision is visible, every action observable, and governance is part of the architecture from the start.

Why is Drupal relevant to AI agent governance?

Because the core problems of governing agents — identity, granular permissions, approval workflows, revision history, structured data, and APIs — are the ones Drupal has solved for more than two decades for governments and large enterprises. Ecosystem initiatives such as AI Core, AI Context, Tool API, and MCP integrations extend those capabilities to AI agent operations.

What does "context will become strategy" mean?

As AI models become interchangeable, competitive advantage shifts to organizational context: brand voice, business rules, taxonomies, workflows, and decision history. Platforms that let the organization own and govern that context — instead of surrendering it to proprietary vendors — protect its hardest-to-replicate asset.

What does it mean for Drupal to be an "AI orchestrator"?

It means Drupal acts as the central point from which an organization coordinates AI models, autonomous agents, and automated workflows — internal and external — applying its native permission, revision, and audit system to every action. The project's official vision, known as DXP 2.0, rests on already-stable modules such as AI, AI Agents, ECA, and Orchestration.

What is the difference between AI governance and AI orchestration?

Governance defines who and what may act, within which limits, and with what traceability. Orchestration is the active coordination of agents, models, and workflows to execute business processes. In Drupal both layers are native and integrated: agents are orchestrated inside the same permission and audit perimeter that governs content.

At Seed EM we design digital experience platforms on Drupal and Ibexa DXP with governed, orchestrated AI integrations: architectures where your organization retains ownership of its content, its data, and its context. If you are evaluating how to adopt AI without surrendering control, get in touch.

Sources

1. Thomas Scola, Drupal CMS and the Rise of the Light Factory (Medium, July 2026). ↩
2. Steve Yegge, Welcome to Gas City (Medium). ↩
3. Driesnote / DXP 2.0 vision (Dries Buytaert, DrupalCon, 2025–2026). ↩
4. Drupal AI Initiative — stable AI Agents framework; funding milestone reached. ↩
5. drupal.org modules: AI, AI Agents, ECA, Orchestration, MCP. ↩
6. Drupal Orchestration Initiative — Jürgen Haas (ECA / LakeDrops), Randy Kolenko (Maestro / Nextide), Shibin Das (FlowDrop / The Drop Times), Dries Buytaert (June–July 2026). ↩
7. Dries Buytaert, The Privilege of AI in Open Source (dri.es). ↩

Published by Seed EM · July 2026.