Heuristic
Treat a provenance gap as an unknown, not a verdict
A missing receipt is not automatically evidence of theft.
When it fits
- A content history has a missing transformation or loses credentials at some point in the chain.
When to avoid it
- Some provenance loss may itself violate a required control or policy even when it does not prove the content is false.
Why it matters
Mark the missing interval explicitly and ask what explanations fit it: unsupported editing software, export/re-encoding, deliberate removal or another workflow break. Increase verification effort around the gap, but do not label the asset false or malicious from absence alone. The useful state is 'provenance incomplete here.'
An example
An image retains a publisher credential but lacks metadata for one crop step performed in a non-aware editor; record the gap rather than inventing the edit history.
Check your result
The review distinguishes missing provenance from verified manipulation and names the next evidence needed.
Keep this limit in mind
- Some provenance loss may itself violate a required control or policy even when it does not prove the content is false.
Connected ideas
Useful withVerify each ingredient at the level the evidence allows
Evidence and sources
C2PA guidance states that provenance can be incomplete when modifications occur in tools or workflows that do not update Content Credentials.
Missing provenance is not automatically evidence of malicious tampering; the gap must be interpreted in context.
C2PA and Content Credentials Explainer · Is provenance always complete?