Ask what proves an AI asset’s history and two answers compete: C2PA content credentials and internal production provenance. Teams conflate them, then discover each stops where the other starts. This guide draws the boundary precisely — it is one of the highest-authority topics a production-infrastructure company can own, because the distinction is technical and few explain it well.
What C2PA actually proves
- Origin claims: which device, software, or service asserts creation — cryptographically signed.
- Edit history: a tamper-evident manifest of asserted transformations.
- AI-generation flags: whether content was generated or modified by AI, as asserted.
- What it does not prove: whether internal versions, prompts, approvals, or rationale were correct — or exist.
What production provenance actually proves
- Recipe completeness: the prompts, models, parameters, and references behind each version.
- Decision history: who revised, who approved, and why.
- Lineage: parents, variants, and derivatives across the campaign.
- What it does not prove: cryptographic authenticity to outside parties — that is C2PA’s job.
Side-by-side
C2PA vs. production provenance
| Dimension | C2PA content credentials | Production provenance |
|---|---|---|
| Trust basis | Cryptographic signatures | Complete internal records |
| Travels with | The file | The asset identity |
| Audience | External: platforms, clients, public | Internal: team, legal, auditors |
| Covers prompts and approvals? | No | Yes |
| Survives screenshots and re-exports? | Often stripped | Yes — lives outside the file |
Adopting both
- Maintain production provenance as the system of record for all versions.
- Sign deliverables with C2PA credentials at export and delivery gates.
- Reference credential IDs inside production records so the two systems cross-check.
- Educate clients: credentials verify the file, records verify the production.
Implementation checklist
Dual-provenance checklist
- Inventory which deliverables need external credentials vs. internal proof.
- Enable C2PA signing on export paths where supported.
- Keep provenance complete regardless of credential status.
- Cross-reference credential IDs in production records.
- Brief legal on which system answers which question.
What to measure in a paid pilot
Track credential coverage on deliverables, provenance completeness, and rights-query response time. Scope a production pilot alongside a security architecture review.
Start with the workflow assessment to find where your team loses context today, read the Production Memory guide, and browse the use-case library for related workflows.
Key takeaways
- C2PA = cryptographic claims about origin and edits, traveling with the file.
- Production provenance = internal record of recipe, decisions, approvals, lineage.
- C2PA verifies the file you hold; provenance explains the production behind it.
- Adopt both: credentials for distribution trust, provenance for production power.