Let AI Draft, Not Publish: A Safe Pattern for AI-Assisted Content

Two Languages, Double the Retyping

Every article for Arc AI's own site starts as a plain document: a title, a body, nothing else. Getting it into the CMS meant retyping the title, address, summary, SEO fields and image caption, then doing it all again in the second language. Slow work invites shortcuts, and a shortcut is how a meta description ends up copied from the wrong article. So the team pointed a language model at the document and asked it to produce everything except the parts a person still needs to think about: what's true, what's ready, and what gets published.

The Job Worth Handing to AI

A slug can only contain certain characters. A meta description has a hard length. Alt text needs to exist. A category has to be one from a fixed list. None of that calls for judgement, it calls for arithmetic and pattern matching, work a model handles well and a person finds tedious.

The brief: read the document, produce a slug, an excerpt, an SEO title up to 60 characters, a description up to 160, up to ten keywords, a category from the existing list, alt text for the hero image, and a translation only when a second-language file was supplied. Nothing about whether the article should exist. Nothing about hitting publish.

The prompt is generated from the same limits the CMS validator enforces, the character caps, the keyword ceiling, the category list, so moving a limit in one place moves it in the other. Two lists kept in sync by hand eventually disagree; one list read twice can't.

Convert, Don't Rewrite

Ask a model to "clean up" a paragraph and it will, whether you wanted it to or not. That's exactly what a CMS import can't afford: the words in the body are the ones the author chose, and they need to reach the database unchanged.

The instruction is narrow on purpose: don't touch the body text, don't translate unless a second-language file was supplied, derive only the listed fields from what's already on the page. It sounds like a small constraint. In practice it's the difference between an import tool and a rewriting tool that happens to also import things.

None of That Trust Extends to What Comes Back

Whatever the model returns is treated like a stranger's file upload, the same checks a human editor's input has to pass, no exceptions for the source.

The HTML goes through a real parser, not a regex, checked against a short list of permitted tags. Everything else is stripped, scripts refused outright, external and embedded images blocked. The body must contain exactly one main heading. A couple of harmless habits, like a model wrapping its answer in a code fence, are tolerated; nothing beyond that.

Every field for both languages is checked before a single one is written. One error anywhere, wrong length, an eleventh keyword, means zero writes. There's no version where the English half saves and the Bulgarian half sits there broken. Even a document that clears every check doesn't go live on its own. It lands as a draft; a person uploads the hero image by hand, since images are never part of the import, previews it, and only then publishes.

Not Every Feature Request Makes the Build

One request came up early: let the document name image URLs and have the server fetch them. It would have saved a step, and also handed anyone editing that document, or the model processing it, a way to make the site's server request addresses of their choosing.

A server fetching an address from an uploaded file is a well-known attack class, server-side request forgery, and a dependable source of hangs even without malice. The feature was refused. Writers still upload images by hand. Sometimes the safest feature is the one that never gets built.

A Quick Checklist Before You Import Anything AI Wrote

• Is the task something your code can actually check, not just hope turned out right?
• Are the prompt's rules generated from your own validators, not copied by hand into a file that will drift?
• Does the AI's output pass the same validation a human's input would have to pass?
• Is the import all or nothing, with every error pinned to a field and a language?
• Does everything land as a draft, with a person still required to publish it?
• Does your server fetch anything the AI named inside a file? If so, take it out.

Where the Judgement Still Lives

None of this makes a model smarter about what's true or what deserves to go out under Arc AI's name. It just gets the repetitive part of an import done, twice, in two languages. The slug, the SEO fields, the alt text: code can check it, a model can generate it. What's true, what's finished, and what gets published stay with a person. In AI integration services, content tools draft from your own data, and a person checks each draft before it goes out.