Trust is not invented from scratch.
The cryptographic rails, the provenance vocabulary, the legal weight of time and the evidentiary forms courts accept all exist and are mature. What has been missing is someone applying them to machine traffic: to what was taken, and what was said.
Existing rails, used as rails.
C2PA
The manifest envelope and the rails already read by Adobe, Microsoft and OpenAI. Observation fields travel inside their format.
W3C PROV
The academic and enterprise language of provenance. Every passport exports to PROV without a converter.
eIDAS / QTSP
A qualified timestamp is what turns a record into documentary evidence inside the EU.
Courts already accept electronic records on a known pattern: a digest of the data, a description of the process that produced it, and a certification by a qualified person. In the United States it is, the shape of self-authentication under FRE 902(13) and (14); in the EU, the presumption that attaches to qualified timestamps. The record is built to fit those forms as they stand. There is no case law on this class of record yet, in either direction, and we state that rather than hide it.
C2PA was designed for a creator signing their own content, and we are an observer, not an author. So this is compatibility of form and rails, not certification. Tools that read manifests read ours, and for the purpose at hand that is enough.
Six layers answer six questions. The centre is empty.
C2PA certifies where content came from. Governance platforms watch the agent. Access infrastructure gets the bytes. Nobody certifies the external fact itself: what was observed, when, from where, and under which rights.
Schematic of adjacent categories, not an exhaustive market map.
| Layer | What it establishes | What it leaves open |
|---|---|---|
| C2PA | Where a piece of content came from. | What a machine observed, and under which rights. |
| W3C PROV | A vocabulary for describing provenance. | Who captured it at the moment of observation, and who signs for it. |
| eIDAS | That a timestamp has legal weight. | What exactly was timestamped, and from which vantage point. |
| zkTLS | That a server really said something, without trusting the observer. | Everything around the response: the terms in force, the chain, custody, and any presence in evidence practice so far. |
| Bot detection | Which traffic to block or charge. | A signed, portable record of what that traffic did. Telemetry stays in the vendor's dashboard. |
| Observability | What happened inside your system. | Anything about the external fact the system consumed. |
| Governance | What the agent did. | What the agent knew. |
| Identity | Who acted. | What they acted on. |
| LENTRA | What was observed, when, how, from where, and under which rights. | Your policy decision: that judgement stays with you. |