Authorship, CRediT, AI, and Confidentiality

Human authorship and accountability

Use the current target-journal authorship policy. For biomedical work, ICMJE's four criteria require substantial contribution, drafting or critical revision, final approval, and accountability for all aspects of the work [SW-S01].

AI systems and other nonhuman tools are not authors. They cannot approve the work, accept accountability, disclose conflicts, or manage copyright and license agreements [SW-S01, SW-S03].

Do not:

add or remove an author without all required human approvals;
infer contributions from author order, affiliations, or email;
generate an author-contribution statement from incomplete records;
use CRediT roles as a substitute for the venue's authorship criteria.

CRediT

CRediT is the ANSI/NISO Z39.104-2022 taxonomy of 14 contributor roles. The standard explicitly describes contributions and does not define authorship [SW-S19].

Record only roles confirmed by the contributor and accountable author team:

Conceptualization
Data curation
Formal analysis
Funding acquisition
Investigation
Methodology
Project administration
Resources
Software
Supervision
Validation
Visualization
Writing – original draft
Writing – review & editing

One person may have multiple roles; a project need not use every role. Non-author contributors may also receive appropriate credit and acknowledgment subject to consent and journal policy.

AI-use disclosure

The January 2026 ICMJE Recommendations require transparency about which AI tool was used and for what purpose, place writing assistance in acknowledgments, and place AI used for data collection, analysis, or figure generation in Methods as applicable [SW-S01, SW-S02]. COPE's formal position likewise requires disclosure and keeps full responsibility with human authors [SW-S03].

Journal and publisher rules differ and evolve. Check them at the time of use and again before submission. Record:

tool, provider, and version or access date;
purpose and affected stage;
whether output entered text, code, analysis, tables, or figures;
human verification performed;
disclosure locations required by the venue;
what material, if any, was sent outside the approved environment;
authorization and policy review for any restricted transfer.

Do not fabricate an AI-use statement or claim that no AI was used. Obtain confirmation from the human authors.

Confidentiality boundary

Do not send any of the following to an external service without explicit authorization and a documented policy review:

unpublished manuscripts or drafts;
peer-review or editorial material;
sensitive or restricted data;
protected health information or other personal data;
proprietary or contract-restricted content;
source documents, including full articles, reports, protocols, and datasets.

Authorization must come from a person or body empowered to grant it and must be consistent with journal policy, consent, ethics approval, contracts, law, institutional policy, and data-use terms. Removing obvious names does not by itself make content safe.

When authorization is absent or unclear, keep processing local and use only minimal metadata. This skill's bundled tools make no network calls and do not read environment variables or .env files.

ICMJE treats submitted manuscripts as privileged communications and warns editors and reviewers not to upload them to AI systems where confidentiality cannot be assured without author permission [SW-S01]. JAMA provides a journal-policy example with the same confidentiality concern [SW-S24].

COPE status as of the research date

COPE's 2017 Core Practices are historical: COPE states they were retired in 2024. As of 2026-07-24, its website stated that a replacement Code of Conduct would be published in 2026; do not present the archived Core Practices as current membership standards [SW-S04, SW-S05]. Continue to use current topic-specific COPE guidance and distinguish formal positions from discussion documents, webinars, comments, and case advice.

Validation

Populate authorship.json, then run:

bash

python3 scripts/validate_authorship.py authorship.json

The validator checks human authorship gates, exact CRediT role names, guarantors, final approval, hashed declarations, AI disclosure, and restricted external-transfer gates. It cannot adjudicate contribution disputes or determine who deserves authorship.