Heuristic

Treat a provenance gap as an unknown, not a verdict

A missing receipt is not automatically evidence of theft.

When it fits

  • A content history has a missing transformation or loses credentials at some point in the chain.

When to avoid it

  • Some provenance loss may itself violate a required control or policy even when it does not prove the content is false.

Why it matters

Mark the missing interval explicitly and ask what explanations fit it: unsupported editing software, export/re-encoding, deliberate removal or another workflow break. Increase verification effort around the gap, but do not label the asset false or malicious from absence alone. The useful state is 'provenance incomplete here.'

An example

An image retains a publisher credential but lacks metadata for one crop step performed in a non-aware editor; record the gap rather than inventing the edit history.

Check your result

The review distinguishes missing provenance from verified manipulation and names the next evidence needed.

Keep this limit in mind

  • Some provenance loss may itself violate a required control or policy even when it does not prove the content is false.

Connected ideas

Useful with
Verify each ingredient at the level the evidence allows

Evidence and sources

Supports

C2PA guidance states that provenance can be incomplete when modifications occur in tools or workflows that do not update Content Credentials.

Missing provenance is not automatically evidence of malicious tampering; the gap must be interpreted in context.

C2PA and Content Credentials Explainer · Is provenance always complete?

All sources (1)