The provenance chain

Eight links from person to buyer. Each can prove one narrow thing.

  1. Real person

    Enrolment

    The person is identified before any work.

    Requirement

    ID + liveness check by a named, audited vendor; re-checked at least monthly

    • Proves Someone passed an identity check
    • Can't prove That they did this capture

    Card fieldPerson

  2. Captured locally

    Capture

    A product on the C2PA Conforming Products List records the scene; where, only if the position is authenticated.

    Requirement

    A product on the C2PA Conforming Products List; place counts only if the position is authenticated (GNSS alone is easy to spoof)

    • Proves A listed product made the capture (the seal binds the bytes); where, only if the position is authenticated
    • Can't prove That the scene was real

    Card fieldsCameraPlace

  3. Genuine device

    Device attestation

    A server checks the app and phone are genuine.

    Requirement

    Hardware key attestation (Android Key Attestation, Apple App Attest), not revoked. Play Integrity checks the app and device, not a key

    • Proves Genuine app passed a check
    • Can't prove It stayed uncompromised afterwards

    Card fieldApp

  4. Sealed capture

    Signing

    A key seals the file and what it says.

    Requirement

    C2PA manifest with hard binding; the signer's certificate chains to the C2PA Trust List

    • Proves Who signed; unchanged since
    • Can't prove That its statements are true

    Card fieldsCameraPlaceContent

  5. Known timestamp

    Time-stamping

    A third party records that it existed.

    Requirement

    RFC 3161 token from an independent TSA, or a transparency-log entry

    • Proves Existed no later than T
    • Can't prove That it was captured at T

    Card fieldTime

  6. Tracked in transit

    Chain of custody

    Every transfer and store is logged: custody, not integrity.

    Requirement

    Hash, holder and time for each hop, in an append-only transparency log

    • Proves Custody: who held it, and when
    • Can't prove That it is unchanged (the seal shows that), or anything about an unlogged hop

    Card fieldOptional card field

  7. Independently verified

    Appraisal

    Someone other than the signer checks it all.

    Requirement

    Validation by a party other than the signer, against a published policy; cross-checks need 2+ independent sources

    • Proves A named party checked stated rules
    • Can't prove More than those rules cover

    Card fieldCross-check

  8. Delivered to you

    Delivery

    The buyer gets the result, checks shown.

    Requirement

    Signed receipt binding file hashes, your request and your nonce

    • Proves What was checked, and what wasn't
    • Can't prove That your use is sound

    Card fieldOptional card field

Where the levels come from. Each link is read from the card fields shown under it, its guarantees. A link counts only what a card actually states: Sealed capture needs a stated signing mechanism (C2PA, a manifest), and Known timestamp needs an attested time (RFC 3161, a log). Levels: Evidenced, Claimed, Reported (a time stated, not attested) or Not stated.

Terms

Liveness check
Shows a live person, not a photo, is present.
Conforming Products List
C2PA's list of cameras and apps that passed its conformance programme.
Key attestation
The phone's secure hardware vouches that a signing key lives in it. Play Integrity is not this: it checks the app and device.
C2PA manifest
Signed record of who made a file and how, attached to it.
Hard binding
A fingerprint of the exact bytes; any change breaks it.
RFC 3161 / TSA
A time-stamp authority signs a fingerprint with the time.
Transparency log
A public record that can only be added to.
Nonce
A one-time code you issue when ordering. A receipt carrying it was issued after your order; it says nothing about when the capture was made.

The same eight links, defined: glossary. Exact rules: standard, Section 3.