Skip to content

Provenance Is Not Control

Digital trust discussions often place provenance, authenticity, integrity, custody, authority, and control close together.

They are related, but they are not the same thing.

The core distinction is simple once named:

Provenance asks where something came from and what happened to it.
Control asks who can exercise recognized power over the record now.

That distinction matters most when the record is not just evidence or content, but something whose value depends on transfer, presentation, redemption, encumbrance, discharge, or exclusive control.

The Basic Difference

Provenance is about history.

It helps answer:

  • who created the asset
  • what system created it
  • what transformations occurred
  • what assertions were attached
  • whether the asset still matches a signed provenance claim
  • whether the provenance signer is trusted

Control is about state.

It helps answer:

  • what the operative record is
  • who currently controls it
  • how control moved from one participant to another
  • whether the record is encumbered
  • whether a prior controller has been superseded
  • whether the record has been redeemed, discharged, or terminated
  • which policy recognizes the resulting state

The compact version is:

Provenance makes history inspectable.
Control makes authority over the record stateful.

Copying Reveals The Distinction

Digital things can be copied.

That is not, by itself, the failure.

The real requirement for transferable records is:

Copying evidence must not copy control.

A copy of a bill of lading may reproduce the visible words, signatures, endorsements, and history. But a copy is not the operative bill merely because it looks the same.

The same point applies digitally.

A participant may copy:

  • the record bytes
  • the metadata
  • the provenance statement
  • the signatures
  • the history
  • the evidence bundle

But copying that evidence should not create a new current controller.

Control depends on the recognized state of the record, not on the mere availability of a copy.

C2PA As Provenance Infrastructure

C2PA is a strong model for content provenance.

It can bind signed claims and assertions to an asset. A validator can check whether a manifest belongs with the presented asset and whether protected content still matches the signed claim.

That is exactly what many media and document workflows need.

C2PA is well suited to questions such as:

  • Is this provenance authentic for this asset?
  • Who or what created this image, video, or document?
  • What transformations occurred?
  • Which assertions are attached?
  • Is the signed manifest still bound to the content?

This is provenance, and it is valuable.

It is not the same as control.

OpenETR As Control Infrastructure

OpenETR implements the control side of the distinction.

It identifies a record by digest and associates signed events with that record.

Those events can express:

  • issuance
  • transfer
  • acceptance
  • attestation
  • encumbrance
  • discharge
  • redemption
  • termination

The resulting graph helps answer:

What is this record, and who controls it now?

OpenETR can carry provenance-like evidence too, but its distinctive role is the control graph: a signed, object-specific history that can be replayed under a verifier policy.

Why They Are Complementary

C2PA and OpenETR are not competing solutions.

They are examples of different trust primitives.

The short comparison is:

C2PA establishes provenance of an asset.
OpenETR establishes control of a record.

Or more sharply:

C2PA makes provenance portable with content.
OpenETR makes evidence portable without making control copyable.

Together, they can be stronger than either alone.

For example:

digital trade record
  -> C2PA provenance for content, media, or supporting evidence
  -> OpenETR digest identifying the controlled record
  -> signed control graph for transfer, encumbrance, redemption, or termination
  -> recognition policy deciding effect

C2PA can tell a relying party where the content came from.

OpenETR can tell a relying party which record is being controlled and what the control graph says.

Recognition policy decides what legal, commercial, institutional, or operational effect follows.

Policy Implications

Policy and technical frameworks should avoid treating provenance as a substitute for control.

A system should not conclude:

This record has authentic provenance, therefore it is controlled.

Nor should it conclude:

This record has a control graph, therefore all provenance claims are trusted.

The better architecture is layered:

Protocol:
  verify hashes, signatures, manifests, events, and references

Control:
  derive record state and current controller from the graph

Recognition:
  decide what effect to give the evidence and state

This distinction is especially important for transferable records, including warehouse receipts, bills of lading, promissory notes, bills of exchange, and other instruments where control substitutes for possession.

Bottom Line

Provenance and control are both essential, but they are different trust primitives.

Provenance explains history.

Control governs state.

C2PA is a strong provenance technology. OpenETR is a control-graph implementation. The useful policy move is to use each where it belongs and avoid asking one layer to do the work of the other.