What is Provenance chain?
A provenance chain is the ordered sequence of actor-signed actions recorded in a content credentials manifest — for AI UGC, typically c2pa.created (the generator claims the pixels), c2pa.ai_generated (the generator asserts machine origin), c2pa.edited (optional retouching), and c2pa.published (the brand signs off on the final asset). Each step is signed with an actor certificate; a valid chain walks from creation to publication with no unsigned gaps. Platforms consuming the chain check every signature and either auto-label the asset or downweight delivery if signatures are missing, expired, or claim inconsistent actions. The chain is what turns ‘this file says it’s AI’ into a defensible chain of custody — the answer to ‘who created this and who published it’ is not a policy document, it’s a set of verified certificates in the file.
How it relates to AI UGC
In a well-run AI UGC pipeline the provenance chain has three actors: the generator (signs c2pa.created and c2pa.ai_generated), any editing tool (signs c2pa.edited if the asset was retouched), and the brand (signs c2pa.published). Regulated categories usually want the brand to run its own certificate for the published action so the chain terminates at the brand’s public identity, not at a delegated signing service.
Key statistics
- Missing or invalid signatures anywhere in the chain typically cause platforms to fall back to a ‘no info’ label, which is a weaker disclosure signal during platform-integrity review.
- Typical AI UGC provenance chains have three to four steps (created, ai_generated, optionally edited, published); chains longer than five steps often indicate excessive round-tripping through unsigned tools that strip the manifest.
- TikTok is the outlier platform that re-signs assets with its own processing actor after ingest, extending the chain rather than preserving it as-is.