What a Valid Provenance Record Still Cannot Prove

A C2PA validator can report meaningful facts about a provenance record: whether its structure is well formed, whether a signature validates, whether a credential is trusted under the validator’s rules, and whether a content binding matches. This chapter follows those states from discovery through judgment. The aim is to interpret “valid” and “trusted” precisely while keeping separate the questions that cryptography and provenance leave to the reader: whether the content is true, whether the history is complete, and whether the audience should act on it.

The difference matters because a green status can be read too broadly. A successful validation result is evidence about a record and its relationship to an asset. It is not a universal endorsement of the asset’s message.

From an unknown record to a trusted manifest

C2PA describes several levels of status. A manifest can be well formed, valid, or trusted. These states are cumulative in the sense that a trusted manifest is also valid, and a valid manifest is also well formed, but each word adds a different condition.

A well-formed manifest satisfies the specification’s structural and assertion requirements. The validator checks that the required components are present and that the assertions, claims, and ingredients conform to the relevant rules. This is a syntactic and structural threshold. It says that the record is intelligible to the validation process; it does not yet say that the signature is good or that the signer is trusted.

A valid manifest has passed additional checks. The manifest has not been modified since it was signed. The claim signature validates. The signing credential is within its validity period for the relevant time, and required revocation checks have not produced a disqualifying result. The validator also checks assertions, ingredient relationships, and, for the active manifest, the hard binding to the asset. A binding mismatch can mean that the asset was modified or that the wrong manifest was located; the validator reports a mismatch rather than guessing which explanation is true.

A trusted manifest adds a decision about the signing credential. The credential has to be trusted by the validator’s applicable trust list. Trust is therefore partly contextual: a validator’s configured trust anchors and purpose matter. A credential trusted for one purpose or by one validator is not automatically a universal guarantee of the signer’s expertise or honesty.