CMS agent permissions became a real operational question in the last week of July 2026, because the plumbing that makes them necessary finally stabilised. The Model Context Protocol reached its 2026-07-28 specification, and Drupal's contributed MCP Server module moved to beta the following day, joining shipped MCP servers from Strapi and Payload. The result is that a coding agent can now create, edit and publish content in production systems through a standard interface.

Agent governance is the question every CMS vendor is now answering in prose and almost none is answering in code. The claim I set out to test: no content management system meets a credible standard for agent governance, and Drupal has published the sharpest articulation of the problem in the CMS space. After reading the primary sources rather than the coverage, the first half holds comfortably.

What is Siteimprove is a harder question in 2026 than it was two years ago, because the company spent the last eighteen months repositioning away from the thing most people know it for. The short answer people usually give to what is Siteimprove is that it is an accessibility scanner. That is one module of several, it is no longer the top of the marketing hierarchy, and the detection engine underneath it is free open source that Siteimprove itself publishes.

Somewhere in the last twelve months the agentic CMS stopped being a pitch and became the default. Sanity, Storyblok and Strapi have all shipped agent capability, and the pattern extends across the category. The marketing for all of it sounds identical, which makes it easy to conclude nothing here needs a decision. That conclusion is wrong, and the reason is narrower than the marketing suggests: these products differ enormously in whose permissions govern the agent once it starts writing.

Ten Drupal security advisories for contributed modules published on August 26, 2026, running from SA-CONTRIB-2026-108 to SA-CONTRIB-2026-117, every one rated moderately critical. Read as a list it is unremarkable maintenance. Read together it is close to a single defect appearing ten times, because six of the ten are the same mistake: a module hands data out through a route, a JSON endpoint or a JavaScript settings blob, and never re-checks whether the person asking is allowed to have it.

Three products, in three unrelated ecosystems, shipped the same idea inside a month. Drupal's Context Control Center, an agency's page-generation tool, and a coding agent's design workflow all concluded that the model was never the bottleneck. The bottleneck is that your brand exists as a PDF, your editorial standards live in a senior editor's head, and neither can be handed to software.

On July 24, 2026, a progress report on the Drupal AI Security Initiative appeared on the Drupal Association blog under the byline farriss. Tiffany Farriss was named interim CEO of the Association on July 15, 2026, nine days earlier, which makes this the first substantial piece of drupal security communication from the new leadership. The headline claim is that a funded, part-time team of named engineers beat its own grant commitments inside six weeks.

Headless CMS MCP support went from novelty to table stakes in about five months, and almost nobody wrote it up as a single event. Each vendor announced its own server, each announcement was read as a product update, and the pattern underneath went uncovered. The pattern is that an entire product category agreed on how software agents talk to it, without anyone convening a standards body.