What is content provenance?

A product photo, from source to publication

1. Source: a photographer captures the product. The agency records the original file, owner and hash.
2. Edit: a designer generates only the background. The edit log identifies the affected component, tool and approved usage.
3. Export: the final JPEG is checked for embedded Content Credentials and its own hash is recorded. The team notes if an optimizer or export stripped metadata.
4. Publish: the agency uploads the approved version, then checks what the platform actually serves and whether an AI label appears.
5. Decision record: the reviewer keeps the asset/version reference, observed credential status, applicable disclosure rule, wording, approval and a time-stamped publication capture.

That chain is more useful than a bare “C2PA present” flag: it tells a client which version was approved, what AI changed and what the audience actually saw.

Provenance is not metadata, a watermark or an AI detector

A valid credential can still describe a component in a way a downstream platform presents too broadly. Conversely, lost metadata does not prove that no AI was used. See AI-generated versus AI-edited and metadata loss.

What should a marketer receive from the agency?

• Final asset ID, version and hash, with the approved source-file reference.
• A component-level AI-use summary: what was generated, altered or merely assisted.
• Observed C2PA status, verifier identity/version and validation timestamp, including unknown or stripped states.
• Rights and consent scope where a real person, voice, stock asset or synthetic performer is involved.
• The disclosure decision, rule snapshot, reviewer and exact audience-facing wording.
• The published URL, served-variant observation, visible label and evidence capture.

Operational model

From provenance signal to durable evidence

Technical and publishing guides

Explore the provenance cluster