Provenance Is Not a Watermark

AI governance has a conflation problem, an expensive one, and it lives inside a single word, provenance.

Ask the AI industry in 2026 what provenance means and you will get a confident, converging answer, content authenticity. Cryptographic credentials attached to images and video. Watermarks surviving compression. Manifests recording which model generated which picture, signed at creation. The standards are real, the engineering is good, the deployments are now mainstream. The major model providers ship content credentials in production, and security agencies recommend them for government media. If your problem is “did a human photograph this, or did a model render it?”, the industry has built you an answer, and it deserves the adoption it’s getting.

Here is the problem. That entire apparatus answers one question, where did this media artifact come from?, and the word “provenance” has quietly come to mean only that. So when an enterprise buyer hears that a platform “provides provenance,” when a board hears that the AI stack “has provenance built in,” when a procurement checklist gets its provenance box ticked by a watermarking feature, an extraordinary substitution has occurred. The organization believes it has purchased accountability for its AI systems. It has purchased captions for its content.

A watermark tells you an image came from a model. It tells you nothing about whether the data that trained the model was still legitimately held. Nothing about whether the purposes that justified collection were long since completed. Nothing about whether a person who invoked erasure two years ago still shapes every score the system produces. Nothing about whether information disclosed to a doctor is now pricing insurance. Nothing about whether the “proprietary” risk profile is a person’s data wearing a corporate costume. The watermark is true, verified, cryptographically impeccable, about the smallest question in the room.

Provenance, the real thing, the thing courts and regulators are starting to demand, is not a stamp on an artifact. It is the answer to a family of questions about where data came from, what it was for, what it became, and what it still touches. And that family has a structure.

Flatland, briefly

In my book on this subject (Provenance) I borrow Edwin Abbott’s Flatland, the two-dimensional world whose inhabitants cannot conceive of a third dimension, and so perceive a passing sphere only as a circle that inexplicably grows and vanishes. Data governance, I argue there, is Flatland. For thirty years we have governed data along a single dimension, space. Where is it stored, which jurisdiction, which transfer mechanism, which border. GDPR’s adequacy decisions, localization mandates, residency clauses, all magnificent spatial infrastructure, answering where with three decades of accumulated rigor.

But data does not live in one dimension. It lives in six. And a one-dimensional governance toolkit perceives the other five the way Flatlanders perceived the sphere, as inexplicable circles. Incidents that appear from nowhere, grow, and vanish, leaving compliance teams certain that something passed through and no framework for naming it.

Here are the six, in one line each.

1. Where, the spatial dimension. The one we built. Jurisdiction, residency, transfer. Necessary, mature, and nowhere near sufficient, the only dimension your current stack governs well.

2. When, the temporal dimension. Data has dates the way it has locations, such as collection time, consent age, erasure windows, retention horizons. Timestamps are legal instruments, not metadata decoration, and most systems treat them as decoration. The new generation of AI and privacy statutes is the first to make time a first-class governance concern.

3. After Consent, the teleological dimension. Every datum was collected for something. When that purpose completes, whether the loan decided, the claim settled, or the treatment concluded, the data’s legitimate life ends with it. Purpose completion is a semantic event, not a calendar one. No retention schedule captures it, because it isn’t a date but a meaning. Almost nobody has infrastructure that even represents purpose status, let alone tracks its completion. This is the dimension the next decade of enforcement will be written around.

4. What Data Cannot Forget, the influence dimension. Once data enters a training run, it stops being a record and becomes influence, embedded in weights, shaping every decision the model will ever make. Delete the file, and the memory remains. The person who invoked erasure has a ghost living in every future score. Machine unlearning is heroic in ambition and, today, partial in result, which leaves a question no court has yet been asked squarely. If your data caused an outcome, what right do you hold in that outcome?

5. The Ungoverned, the contextual dimension. Information disclosed to a physician carries the norms of that disclosure. Flowing to a specialist honors them, flowing to an insurer violates them, regardless of what a consent banner said. This is Helen Nissenbaum’s contextual integrity, and AI training is its systematic demolition, because models trained on data from a hundred contexts collapse those contexts by design. The collapse is not a side effect of the product. It is the product.

6. What Remains, the transformation dimension. Raw data becomes a score, a profile, an embedding, a weight, and at each transformation, the processor claims the output as its own “created data,” free of the original subject’s rights. The Ship of Theseus, asserted as a business model. The inference about your creditworthiness is not the company’s creation. It is you, transformed, and the legal argument that rights survive transformation is coming to courtrooms with more force than the industry is pricing in.

Six dimensions. The watermark conversation, for all its genuine merit, lives in a corner of dimension one. It tells you the spatial origin of a media artifact. The other five dimensions, for the data inside your models and the decisions coming out of them, are governed today by silence, assumption, and the increasingly expensive hope that nobody asks.

Why single-dimension assurance is worse than none

False assurance is the specific danger here, and it’s worth being precise about its mechanics. An organization with no provenance story knows it has a gap. An organization with a watermarking deployment has a word, “we have provenance,” that circulates upward through governance decks until the board believes a six-dimensional liability is handled because a one-dimensional feature shipped. The vocabulary did the damage. The sphere passes through, everyone sees the circle, the checkbox is ticked.

And the questions arriving from regulators and litigants are unmistakably multi-dimensional now. Erasure requests that ask about models, not just databases, dimension four. Enforcement actions on purpose limitation, dimension three. Discrimination claims that turn on training data crossing contexts, dimension five. Disputes over whether derived profiles are personal data, dimension six. Each lands on a dimension your content-credential deployment does not touch, was never designed to touch, and honestly never claimed to touch. The overclaim happened in the conference room, not the spec sheet.

The buyer’s guide: seven questions for anyone selling you “provenance”

So the artifact this week is procurement armor. The next time a vendor, an internal platform team, or a slide says provenance, ask the following.

1. Provenance of what? Media artifacts, or data lifecycles and decisions? If the demo is an image with a credential badge, you are buying captions. Possibly excellent captions. Captions.
2. Which dimensions? Can the system answer where AND when AND for what purpose, or only the first? Ask them to show purpose, not storage.
3. Can it represent purpose completion? Not retention dates, but semantic purpose status. Is there any object in the system that knows the loan was decided and the data’s justification ended?
4. Does deletion reach influence? When erasure fires, what happens to the trained models, embeddings, and caches the data already shaped? If the answer is “we delete the source record,” dimension four is ungoverned.
5. Does data carry its context? Is the original disclosure context represented at all, and can cross-context use be detected, or at least seen?
6. Does lineage survive transformation? When data becomes a score or an embedding, does the record persist through the transformation, or does it conveniently end exactly where the vendor’s ownership claims begin?
7. Who can verify any of this without trusting you? Self-attested provenance is a diary, not evidence. (This question opens a door big enough for its own essay, several, in fact.)

Most vendors will answer question one honestly and stall by question three. That is not an indictment of them, because content authenticity tools were built for content authenticity, and the good ones are good. The indictment is reserved for the word doing unsupervised work in your governance documentation, provenance, claimed in one dimension, believed in six.

Name the dimensions, and the false assurance loses its hiding place. That is what this series will do, dimension by dimension, gap by gap, because the organizations that learn to see all six first will spend the next decade with a structural advantage over those still watching circles appear and vanish.

Next in this series comes what happens when an artifact’s journey has to survive a courtroom, why AI’s records fail the oldest evidentiary test there is, the chain of custody.

---

Dr. Anandkumar Prakasam works at the intersection of computer science and law. This essay opens The Six Dimensions series, drawn from his book Provenance: How the Six Dimensions of Data Will Rewrite Privacy, Power, and Accountability, published today by The Forensic Brief.