>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3593371. --> Reported by: [alex ua](https://www.drupal.org/user/110386) Related to !42 >>> <h3>Summary</h3> <p>The <code>ai_migration_example</code> submodule ships example migrations and field configuration that assign migrated content the <strong><code>full_html</code></strong> text format. <code>full_html</code> is the least-restrictive core format &mdash; it applies no tag filtering, so any markup is stored and rendered verbatim.</p> <p>That is a poor default to demonstrate for this module specifically, because the field values come from <strong>AI model output</strong> that the pipeline writes to the entity <strong>without a re-sanitization pass</strong>: whatever markup the model returns (it is instructed to extract content, and will faithfully reproduce markup from the scraped source) is stored as-is. Shipping <code>full_html</code> in the example normalizes a permissive default that downstream users copy into production.</p> <h3>Where</h3> <p><code>full_html</code> is baked in at three layers of the example, including the AI prompt itself:</p> <ul> <li><strong>Migration <code>default_value</code></strong> sets the format to <code>full_html</code>: <ul> <li><code>migrations/simple_content_migration.yml:82,88</code></li> <li><code>migrations/complex_content_migration.yml:80</code></li> </ul> </li> <li><strong>Field config</strong> depends on / allows <code>filter.format.full_html</code>: <ul> <li><code>config/optional/field.field.node.simple_content_migration.field_post_content.yml:7,24</code></li> <li><code>config/optional/field.field.node.simple_content_migration.field_publishing_information.yml:7,24</code></li> <li><code>config/optional/field.field.node.complex_content_migration.field_description.yml:7,23</code></li> </ul> </li> <li><strong>The AI prompt steers the model to <code>full_html</code>.</strong> The <code>field_post_content</code> field description (used to instruct the model) ends with: <em>"Set format option to 'full_html' always."</em> (<code>&hellip;field_post_content.yml:17</code>). So even a user who tightens the field's allowed formats is still prompting the model to emit <code>full_html</code>.</li> </ul> <h3>Proposed resolution</h3> <p>Switch all three layers to a filtered format (e.g. <code>basic_html</code>):</p> <ol> <li>Migration <code>default_value: full_html</code> &rarr; the filtered format.</li> <li>Field config <code>full_html</code> dependency/allowed-format &rarr; the filtered format.</li> <li><strong>Update the prompt instruction</strong> in <code>field_post_content</code>'s description so it no longer tells the model to "Set format option to 'full_html' always" &mdash; point it at the safe default instead.</li> </ol> <p>No functionality is lost for the example's purpose; it just models a safe default for machine-generated content.</p> <h3>Remaining tasks</h3> <ul> <li>Confirm the exact filtered-format machine name available in the example's install profile (<code>basic_html</code> ships with the Standard profile; verify rather than assume).</li> <li>Update the listed migration YAML + field config to that format.</li> <li>Optional: a one-line note in the example README that the chosen format is a safe default and operators should pick the format appropriate to their content.</li> </ul>