# Review credits an AI agent added

> An AI agent can fill in who made a file and its license, but DiceyTable won't publish until a person checks and signs each credit. Here's how to review them.

- Question: Why must I review credits an AI agent added before publishing?
- Source: https://diceytable.com/docs/ai-agents/concepts/ai-attested-credits
- Last verified: 2026-10-09

A credit is a claim about who made a file and how you may use it, published in your name. An agent can get that wrong,
so DiceyTable won't publish your game until a person has checked and signed every credit an agent wrote.

You'll need this page when you let an agent [import models, images and sounds](https://diceytable.com/docs/ai-agents/workflows/importing-assets),
and again when you [get your game ready to publish](https://diceytable.com/docs/ai-agents/workflows/publish).

## What is an AI-attested credit?

Every file in a mod needs a **credit record**. It says who made the file, under what license, and carries a signed
statement that the record is true. [Credit and being credited](https://diceytable.com/docs/mods/publishing/attribution) covers credits in
general. When you import a file yourself, you answer those questions and sign.

An agent can answer them too, with the `credit` argument of
[`asset_import`](https://diceytable.com/docs/ai-agents/reference/tools/assets-and-credits#assetimport) or with
[`credits_attest`](https://diceytable.com/docs/ai-agents/reference/tools/assets-and-credits#creditsattest). Its answer holds everything yours would. In place of
your signature, it carries an **AI attestation**: a note that an agent made the claim. The attestation records:

- the version of the statement text the agent was shown
- which agent session made it, and the agent's name (for display only)
- when it was made
- for a web download, where the file really came from after redirects, its size, when it was fetched, and its
  SHA-256 hash (a fingerprint of the exact bytes)

In the editor, the record shows a chip that reads **AI-attested · unreviewed**. Once you sign it, the chip reads
**AI-attested · reviewed**. The note that an agent wrote it never goes away.

## Why is publishing refused?

An agent can be wrong. It can also be misled: a web page it read might claim a file is free to use when it isn't. And
the claim goes out on a public repository in your name. So DiceyTable holds to one rule.

> **⚠ No publish while an AI credit is unreviewed.** That holds whether you or the agent asks to publish.

Three separate checks enforce it, so nothing in the browser can get around it:

1. **The editor.** The **Publish** button stays off, and
   [`publish_preview`](https://diceytable.com/docs/ai-agents/reference/tools/projects-and-publishing#publishpreview) lists each unreviewed record as a blocker.
2. **The server.** It refuses the publish with `ai-credits-unreviewed`. The message starts *"Review the credits an AI
   agent attested before publishing"* and ends *"Nothing was published — the release branch is unchanged."*
3. **The registration scanner.** A manifest pushed to GitHub some other way is rejected with `ai-credit-unreviewed`,
   so it can't be registered either.

An older copy of DiceyTable that has never heard of AI attestations sees an unsigned record, and refuses it too.

This rule is narrow on purpose. A file with **no** credit still doesn't block publishing. Only a credit that an agent
vouched for and nobody checked does.

## How do I review an AI-attested credit?

1. **Open the review panel.** Go to **Mod ▸ Mod Details…** and pick the **Credits** tab. The panel also appears in the
   Publish dialog. Its heading reads *N credits an AI agent attested need your review*.
2. **Read each record.** It shows the files, the origin, the creator and license with their links, and the source
   address. For a download, it also shows where the file really ended up and its hash. Below that is the full
   statement you are about to sign.
3. **Check it.** For a download, compare where the file came from with where it should have come from.
4. **Tick the box.** It reads **I have checked this record, and the statement above is accurate.** For a `disclaimed`
   record, it ends *…and I take responsibility for these files as stated above.* **Select all** ticks every record.
5. **Sign.** Type your name in **Sign with your name**, then click **Sign N reviews**. The draft saves.

Signing adds your review to the attestation, plus an ordinary signature. From then on, the record is yours.

An agent can't do this step. The panel is out of every agent's reach, there is no review tool, and a signature
triggered by an agent's action is refused.

## When does a credit need signing again?

Some edits change what a credit claims, so they need a new signature. These include changing its origin or its
details, adding files to it, and creating a new record.

| Who makes the edit | What happens |
|---|---|
| **The agent** (`credits_edit`, `credits_attest`, `asset_import`) | Your signature and review are removed, and a new AI attestation is recorded. The record is unreviewed again, and it blocks publishing until you review it. |
| **You**, in the credits editor | You sign as usual. An AI-attested record becomes reviewed, because you just signed it. |

Removing files from a record, or deleting it, needs no signature. Those edits leave the record as it was.

## Help your agent attest honestly

Ask your agent to name the real creator and license whenever a file came from someone else, using the `third-party`
origin. `disclaimed` is for files whose source truly can't be named. It puts all the responsibility on the person who
signs. [`credits_list`](https://diceytable.com/docs/ai-agents/reference/tools/assets-and-credits#creditslist) shows every record, every file with no credit,
and every record waiting for review.

## Related

- [Get your game ready to publish with an agent](https://diceytable.com/docs/ai-agents/workflows/publish): what the agent can and can't do
  at publish time.
- [Credit and being credited](https://diceytable.com/docs/mods/publishing/attribution): credits for every file, agent or not.
- [How URL imports are fetched safely](https://diceytable.com/docs/ai-agents/concepts/url-imports): where the download details come from.