Check provenance offline, before the file has moved.

A screenshot is not a file. Right-click and save, download the original attachment, or open the source the sender provided. If the only version available is a screenshot, provenance is already unavailable and the finding is that no check can be made.

Note where it came from: an email attachment, a shared drive, a supplier portal, a stock library. That note is part of the record, because the path explains more than the bytes do.

Open the verification console, choose the image tab, and select the file. Decoding and marker inspection run in the browser, so nothing is transmitted.

The report lists dimensions, weight, contrast, and every provenance marker found: a C2PA container, Content Credentials strings, generator names such as Firefly, Midjourney, DALL·E, Stable Diffusion or ComfyUI, an XMP block, and an embedded colour profile.

Write down the list rather than remembering it. The comparison at the end of the process is the part that carries the evidence.

A manifest present on a file from a studio that signs at export is expected, and its absence would be the notable finding.

A manifest present on a file from a stock library that does not sign is interesting and needs a question. Absence on a file that has been resized twice is not a finding at all.

Set that expectation before reading the result. A finding evaluated against no expectation is just a string in a report.

Take a copy and run it through the pipeline: the resize step, the export preset, the CMS upload. Check the output at each point.

This is the step people skip and the one that produces the useful answer. Knowing that your CMS strips manifests tells you where to put the retention step, and it explains every future absence without an investigation.

Keep the original untouched throughout. The derivative chain is disposable; the original is the evidence.

A provenance record is four lines: what the file is, what the check found, what it did not check, and who looked at it.

Escalate when the image is used as evidence, appears under a client's name, implies documentary status, or sits in a regulated context. Those are the cases where a signature on a scope is worth paying for.

Escalate when the supplier's account and the file disagree. That mismatch is more informative than either input alone, and it needs a person to pursue it.

Do not escalate a decorative image with no markers. It is the normal state, and turning it into an investigation trains people to ignore the process.

It runs on unreleased material without creating a copy anywhere, which is why it can be used during a campaign build rather than after publication.

It produces a repeatable artefact rather than a judgement, so two people checking the same file get the same list.

And it states its own limit, which is the property that makes it usable in a report somebody else will read.