"The update is built, versioned, and deployed as part of the call: there is no separate publish step."
That sentence lives in Figma's developer docs, under the heading for updating a shader. It is the most honest line the company has published about what authorship now means, and almost no one designing in Figma will ever read it.
This week Figma gave us a spec to test that against, and the spec answers plainly.
Start with the act itself, stripped of marketing. You open a Figma Design file, click Agents, and type "Build me a shader." The agent writes `main.ts`. Then, per Figma's docs, an `update_shader` call reportedly builds it and versions it with a 40-character commit SHA, though a successful response may omit the version, and deploys it under an owner field that can be your email.
There is no publish button in the sense anyone means the word. There is a commit, and it arrives already signed by you.
The consumer-facing story is deliberately smooth. Rogie King's launch post reportedly frames it as collaboration: "in collaboration with AI, moving fluidly between design and code, and together on the canvas." The help center is blunter and stranger: "No need to understand code or technical terminology—you explain it, the Figma agent will build it."
So you don't need to understand the code. But you will own it. Hold those two facts next to each other, because Figma's own MCP spec does.
Read the developer docs and the pipeline is not "create, then publish." It is scaffold-then-replace. `create_shader` returns a resource that "already exists and already runs: it is a starter, not an empty file." Then `update_shader` overwrites `main.ts` with "complete replacement content, not a diff or a fragment."
And that update is the whole event. Built, versioned, deployed, in one call. The update to the resource itself is built, versioned, and deployed in one call with no separate publish step; publishing to the Community remains a distinct capability per Figma's materials.
This is where authorship stops being a story about creative intent and becomes a data field.
Call `get_shader` on Figma's own "Glowing wave" and the JSON returns an `owner` value of `figma`, plus a `version` that is a 40-character commit hash. That `owner` field is the entire theory of authorship in this system, and the docs spell out its three possible states.
Your email address means: "You own it: source readable and writable." The literal string `figma` means a first-party resource. A public publisher handle means a third-party published plugin.
That is it. Authorship has been reduced to an attribution enum — three values, machine-checked, no room for "well, the agent wrote most of it."
Authorship has been reduced to an attribution enum — three values, machine-checked, no room for 'well, the agent wrote most of it.'
Notice what the enum does and does not claim. It records who is accountable for the artifact. It says nothing about who conceived it, wrote it, or read it. When your email sits in that field, Figma treats the signature as binding — the source is "writable" because you're responsible for it — while the actual creative act happened inside a model you never audited.
You are being credited for code you didn't write and, per Figma's own framing, reportedly may not be able to evaluate. The signature is real. The authorship it implies is a courtesy.
Then it gets more honest, and more unnerving. The docs note that a successful write "may omit" the version, and instruct: "Treat any non-error response as success and record the version when present."
Record the version. Not the reasoning, not the review, not a sign-off. The version — the commit SHA — is the thing that persists as proof you were here. Publishing, at the level of the machine, means putting your name on a hash and calling it ownership.
If this feels like a bug in the framing, the origin story suggests it is the framing all the way down.
The feature you are now using to sign artifacts began, by its creator's own account, as one. "In January, i vibe coded a prototype, called FigGPU," King reportedly wrote — "real, raw screen captures of me exploring the possibility of these." A vibe-coded demo, negotiated up through a rendering engineer, in what King describes as a joint effort that reportedly "ripped out my WebGL 2 fragment shader system," and a PM who tied it into a shippable pitch.
King is candid that this is how the work now happens. The whole team's process was authorship-by-negotiation: he supplied the vision and the demo, Yassir Solomah reportedly supplied "the core implementation, the security model," Georgia Rust supplied the plan. No single person authored the feature in the old sense, and the shipping product encodes that same assumption for everyone downstream.
The customer quotes in the launch material say the quiet part without flinching. Creative technologist Anna Zhang reportedly describes building her shaders as "a back-and-forth dialogue between me and the agent" — and then, precisely, "It was like a negotiation."
Negotiation is the right word, and it is not the same as authorship. In a negotiation, no party wrote the final text alone, yet the contract still needs one accountable signatory. The `owner` field is that signatory line.
Which reframes what the Figma Community becomes. Not a gallery of things people made, but a marketplace of signatures — commit hashes attributed to accountable owners, where the reviewer, the author, and the credit have quietly detached from one another.
The reviewer, in most cases, is arguably a compiler. The docs' failure path is telling: when a build fails, "make the smallest source correction it points to and retry once," and if it fails again, "surface the error rather than rewriting the resource repeatedly." That is the extent of the gate. It compiles or it doesn't.
The author is a model whose output nobody is required to read. The docs even warn that when updating an existing resource you should "read the current source first so you do not silently drop code" — an instruction that only exists because the default behavior is to not read it.
And the credit is your email, sitting in an enum, binding you to all of it.
This is not an accusation that Figma is hiding anything. The opposite — the spec is remarkably candid, more candid than the blog. The dishonesty, if there is any, lives in the gap between the help center's "you explain it, the Figma agent will build it" and the developer docs' "you own it: source readable and writable."
One sentence tells you the machine does the work. The other tells you your name is on the outcome. Both are true. Figma has simply declined to say them in the same breath, to the same audience.
Murphy Trueman, who per the source's domain writes about agents authoring design systems, put the structural problem well: ask who signed off and the honest answer is "whoever happens to look at the next PR," which is "hope dressed up as a review process." Figma's publishing pipeline is that hope, formalized into a commit and an ownership record.
So here is the uncomfortable settlement. Publishing an agent-built shader to the Community now means putting your name on a version-controlled artifact you may never have read, in a system that treats your signature as binding while quietly disowning the code inside it.
The `owner` field says you own it. The scaffold-then-replace pipeline says the agent built it. The compiler says it runs.
Nobody in that sentence is a person who read the code and decided it was good. That decision — the one authorship used to mean — has been optimized out, and what remains is a hash with your email attached to it.