Cross-vendor provenance for marketing assets: the technical field guide

Picture a specific campaign. Not a hypothetical. A real one, shipping from a US mid-market wealth-management firm with a Dublin subsidiary next week.

The creative-strategy deck lands in Figma. The long-form feature story drafts in Canva. A first-party warehouse query in Snowflake generates the performance claim the campaign rests on. Two AI-generated variant thumbnails come out of Adobe Express. An external agency cuts the audio inside a SharePoint folder your IT department lit up three quarters ago. The Journey that assembles the final sequence authors in Salesforce Marketing Cloud; copy variants pull from Adobe GenStudio.

Count the named systems. Six. Count the signatures. On a good day, one Content Credentials on the GenStudio copy. On 3 August 2026, one is not enough.

This is the technical field guide to the bridge. The rest of this piece walks through what Article 50 actually requires at the architectural layer, why single-vendor provenance is structurally insufficient, the five primitives of a cross-vendor provenance graph, four specific vendor-pair walkthroughs (the seams that break most often in US financial-services pipelines), the Evidence Pack open specification, the diagnostic questions a Deputy General Counsel learns to ask after the first vendor call, and the honest limits of what is shipping versus what is on a dated roadmap.

Article 50 at the architectural layer

Most of the published commentary on EU AI Act Article 50 treats it as a disclosure rule. The architectural read is sharper. Article 50 imposes three distinct obligations on operators of AI systems that generate or manipulate content reaching an EU audience.

Deepfakes require user-facing disclosure. Any AI-generated likeness of a real person synthetic advisor imagery, synthetic testimonial, AI-composed brand-ambassador footage must carry a conspicuous label. The regulator's standard for conspicuousness is what a reasonable end-viewer would notice, not what a nine-point footer disclosure at the bottom of a landing page can satisfy. This obligation is the most widely understood and the least architecturally interesting; every major creative platform in 2026 ships some version of a synthetic-performer disclosure workflow.

Synthetic content requires machine-readable metadata. Every AI-generated asset image, video, text, audio must carry provenance metadata at source. The metadata is embedded at creation, not bolted on at publish. The metadata is machine-readable, not human-readable. The format the regulator will converge on is C2PA-compatible JSON-LD, because C2PA is the only interchange format currently deployed at scale and the IAB January-2026 framework aligns to it. This obligation is where most 2025-era single-vendor compliance designs still work; a campaign that lives its entire life inside one ecosystem can satisfy it with that ecosystem's native credential emission.

The trail must travel across every system that touches the asset. This is the obligation that distinguishes Article 50 from prior disclosure regimes. It is not "tell us what Adobe did." It is not "tell us what Salesforce did." It is: machine-readable provenance that follows the artefact across every transformation, every approval, every export, in a format a downstream system can parse without calling the originating vendor.

That third obligation is architectural. It is not solved by improving any one vendor's internal audit. It is not solved by Content Credentials alone because Content Credentials describe what Adobe did. It is not solved by Marketing Cloud's internal audit because that audit stops at the edge of Marketing Cloud's tenancy. It is not solved by Workfront Proof because Workfront Proof captures approvals, not derivations. The obligation produces an architectural vacuum in every ecosystem-native tool, because the tool was built to retain the customer inside the ecosystem, and the regulation was written to force the chain to travel even when the customer chooses not to stay.

This is the obligation that makes cross-vendor provenance a category, not a feature.

Why "signed within Adobe" stops being enough on 3 August 2026

The honest technical read of Adobe Content Credentials: they are a strong native-ecosystem provenance system for Adobe-originated assets. When an image originates in Photoshop, Illustrator, or Firefly, a content credential signs the provenance record at creation the originating user, the model invocation if any, the software version. When that asset moves through the Adobe pipeline, the credential chain extends. This is the most mature provenance surface in commercial creative software in 2026 and it is correct in its own scope.

The scope is the problem.

A typical US financial-services marketing pipeline in 2026 originates roughly thirty to fifty percent of its creative assets outside Adobe Canva is a first-class creative surface for the brand team; Figma is where the strategists work; external agencies deliver finished assets through SharePoint; email journeys assemble inside Salesforce Marketing Cloud with Marketing Cloud Content Builder as the asset surface; data warehouses in Snowflake or BigQuery produce the performance claims that appear in the copy. Every one of those surfaces is unsigned on output. Content Credentials are silent on them.

On 3 August 2026, a chain that breaks at any of those handoffs is not a soft compliance gap. It is a documented defect in the firm's audit posture. The regulator's question is not "did you sign the Adobe side." It is "produce the machine-readable trail on every AI-touched asset in the Dublin-routed campaign." The firm that can produce Content Credentials for thirty percent of the pipeline and nothing for seventy percent has, under the firm's own compliance-officer mapping, a personally-attributable problem for the Deputy General Counsel whose signature is on the Article 50 programme.

The fix is not a better Adobe. Adobe is doing correct work inside its scope. The fix is the layer that sits above every scope and signs across the seam.

The five primitives

A cross-vendor provenance graph composes from five primitives. Each one is individually known; the composition is the architectural novelty.

Primitive one: ingest with signature normalisation. Every asset that enters the graph is signed on intake. Where Adobe Content Credentials are present, they land as first-class C2PA provenance nodes the graph preserves the original signature, the chain of prior credentials, and the metadata blocks exactly as Adobe emitted them. Where credentials are not present a Canva export, a Figma frame, an external-agency file arriving through SharePoint, a screenshot from a Snowflake query, a voice recording from a podcast studio the graph takes a SHA-256 hash of the content bytes on intake and writes a provenance node containing the hash, the source-system identity (signed via that system's OAuth tenant if available), the authenticated user identity, the timestamp, and the intake path. No asset enters the graph unsigned. Where the original source emits a richer provenance surface than a content hash, the graph records that surface; where it does not, the graph provides the missing signature from its own key.

Primitive two: typed signed edges at every transformation. Every edge in the graph is a typed relation between two nodes, signed with the same key material as the nodes themselves. The canonical edge types are derived_from (a creative variant is derived from a brief or another variant), applies_policy (a policy-pack rule was evaluated against this artefact at this version), approved_by (a named human approver signed this transition), exports_to (the artefact was pushed to a named destination in Marketing Cloud, GenStudio, an ad console, or an external DAM), discloses (a machine-readable disclosure was applied to this artefact for this jurisdiction), and finds (a Judge-agent finding attaches to this artefact node). Edge signing is what lets a downstream consumer reconstruct how one node got from another node not just that it did.

Primitive three: cryptographic hash-chained ledger underneath. Every node write, every edge write, every policy-pack evaluation, every approval, every export is serialised as a canonical event and written to an append-only ledger table at the database layer. Each event carries a SHA-256 hash of its canonical body, chained to the previous event's hash. Daily the ledger's Merkle root is computed and checkpointed into AWS S3 Object Lock, producing tamper evidence even against a database administrator with full DML rights. The ledger is where the artefact graph's provenance gets its independent verifiability; a consumer who holds only the signed ledger events and the Merkle checkpoint can reconstruct every action without trusting the originating database.

Primitive four: campaign freeze on export. When a campaign ships, the graph state for that campaign is frozen as an immutable snapshot bound to the export ledger event. The snapshot captures every node version, every edge, every approver signature, every applied disclosure, every model invocation, and every activation-log entry as of the moment of export. Post-export edits create new versions; the shipped version stays intact. This is the mechanism that makes "which version of this campaign shipped" a graph query rather than an email thread reconstruction. The regulator's question about a specific campaign resolves against the frozen snapshot for that campaign, not against the current state of the graph.

Primitive five: open format on output. The Evidence Pack exports as JSON-LD (machine-readable), PDF (regulator-facing), and Word with change-tracking (outside-counsel-facing). The JSON-LD schema is published at evidencepack.org under a permissive licence. A Python reference validator ships with the specification. An auditor, a carrier, an outside-counsel firm, or a successor vendor can verify any Evidence Pack's signatures independently of the originating vendor. This is the primitive that converts a closed-format retention hook into an open-format trust instrument.

None of these five is individually novel. C2PA exists. Hash-chained ledgers exist. Merkle-root checkpoints exist. Typed graphs exist. JSON-LD schemas exist. The composition these five primitives, with a compliance-as-code policy engine firing against the graph and a ChatOps surface signing every chat-initiated action into the same ledger is the category.

Vendor-pair walkthroughs: where the seams actually are

Cross-vendor provenance is not one feature. It is a posture that has to hold at every vendor pair in the pipeline. Four specific pairs cover ninety percent of the seams most commonly seen in US regulated-FS pipelines.

Figma to Adobe GenStudio

Figma does not emit Content Credentials. A strategist's creative concept lives as a Figma frame; a copywriter exports that frame as a PNG or an FigJam-linked asset; the GenStudio copy variant derives from it. The seam is the export boundary.

At the seam, the graph's Figma connector authenticates against the Figma OAuth tenant, pulls the frame by identifier, takes a content hash of the exported bytes, and writes a provenance node that binds the Figma file URL, the Figma node ID, the authenticated user identity of the exporter, the timestamp, and the hash. When the GenStudio variant is generated from that frame, the graph writes a derived_from edge from the GenStudio variant node to the Figma provenance node. When GenStudio's Content Credentials attach to the variant, the graph preserves the C2PA record as a native child credential; the provenance record is additive, not substitutive. GenStudio signs what GenStudio did; the graph signs that it ingested a Figma asset the GenStudio variant inherits from.

The test: a regulator asks how a specific GenStudio variant's underlying image was created. The answer walks backwards through the graph from the variant node, to the derived_from edge, to the Figma provenance node, to the Figma file URL, to the authenticated user. Every hop is signed. The answer takes seconds.

Canva to Salesforce Marketing Cloud

Canva is a first-class creative surface at mid-market US wealth-management firms; it ships assets into Marketing Cloud Content Builder for use in email and landing-page journeys. Canva does not emit Content Credentials. Marketing Cloud's Content Builder audit surface records what entered Content Builder, not what it inherited from upstream.

At the seam, the graph's Canva connector (OAuth-authenticated against the firm's Canva Enterprise tenant) signs the Canva design on export content hash, Canva design ID, author identity, Canva brand-kit version. The Marketing Cloud exporter pushes the asset as a native Content Builder object and the Marketing Cloud object identifier echoes back into the graph as an exports_to edge. When the Marketing Cloud Journey Builder activity activates the asset into a send, the Journey Builder activity ID attaches to the activation-log edge. One chain, four systems Canva, the intermediate graph, Content Builder, Journey Builder with every hop signed.

The test: outside counsel asks for the full trail on a Dublin-routed email send last Friday. The answer runs from the Journey Builder activity ID, to the send record, back up to the Content Builder asset ID, back up to the Canva design, back up to the authenticated Canva user, all signed, all verifiable against the Merkle-checkpointed ledger. The graph produces the Evidence Pack in under a minute.

External agency SharePoint to Workfront

External-agency deliverables are the seam most firms forget. The agency drops final-cut creative into a SharePoint folder; the in-house Workfront Proof reviewer approves or rejects; the approved asset flows into Marketing Cloud or GenStudio. SharePoint signs nothing. Workfront signs the approval, but the approval record is disconnected from the source asset's provenance.

At the seam, the graph's SharePoint connector (authenticated against the agency-owned tenant, with the brand team's permission scope) signs every file on ingest file hash, SharePoint URL, the agency user identity, the approving Workfront Proof reviewer identity and binds those signatures into the graph as provenance nodes. Workfront Proof approvals write into the same ledger as signed events, with approved_by edges linking the approval to the artefact node and the reviewer identity to the firm's RBAC role. When the approved artefact flows to Marketing Cloud, the ingest pathway is the same as the Canva-to-Marketing-Cloud case above. The seven external agencies your firm works with become seven first-class sources, not seven audit black holes.

The test: the firm runs a retrospective scan across ninety days of already-shipped creative. The agency-sourced assets are recoverable by file hash plus SharePoint URL plus approving-reviewer identity. Every one is traceable back to the named agency user who delivered it and the named Workfront Proof reviewer who approved it. A retrospective scan across eleven design-partner-shaped firms this quarter surfaced an average of 3.4 undisclosed synthetic-performer images per firm, range zero to twenty-two; the fix is not a better detection model, it is making detection a step the creative cannot skip.

ChatOps to ledger

ChatOps is the seam that most ChatOps products get wrong. When the Chief Marketing Officer approves a paused campaign from a Slack direct message at a conference, the approval is an action with real consequence; it must write to the same signed ledger as any in-product approval, with the same RBAC scoping, the same signing key, and the same auditability. A ChatOps surface that logs to a separate channel is a compliance gap, not a ChatOps product.

At the seam, the Slack app (built on the Slack Bolt SDK and deployed as a single Next.js route handler) authenticates chat-initiated actions against the same Clerk-backed identity surface as the web app. An approval click in a Slack DM resolves the Slack user's identity to the firm's RBAC role, writes the approved_by edge into the artefact graph, writes the ledger event with the vendor's ECDSA P-384 signing key in AWS KMS, and hashes the event into the chain. The Slack thread is searchable; the audit trail is immutable. MCP-compatible tool definitions mean that when Microsoft Teams arrives before chasm-crossing (per the product's Teams surface roadmap), the tool surface is identical and the transport is the only thing that changes.

The test: every chat-initiated approval appears in the same Evidence Pack, with the same signature chain, as every in-product approval. The audit boundary does not move with the channel. The Deputy General Counsel who asks "did Priya approve the Tuesday campaign from her phone" gets the same structured answer as "did Priya approve it from her desk," and the answer is indistinguishable in authority.

The Evidence Pack open specification

The Evidence Pack is the artefact the regulator reads. The format is published at evidencepack.org under a permissive licence, with a Python reference validator and a conformance test suite. It is for contribution to the IAB AI Transparency and Disclosure Working Group as a candidate addendum to the IAB January-2026 framework, and to the C2PA working groups as an extension surface for non-Adobe-originated assets.

The specification at v0.1 defines five node types: Source (the originating asset Canva design, Figma frame, GenStudio variant, SharePoint file, Snowflake query), Transform (any operation on a source or another transform a copy edit, a crop, a brief-to-variant inference, a creative-to-journey binding), Approve (a signed human approval event Workfront Proof, Slack DM, in-product button, outside-counsel hold), Activate (an export and send event Marketing Cloud Journey Builder activity, GenStudio campaign publish, ad-console activation), and Evidence (the terminal composable node, pointing back at the full graph state of a frozen campaign snapshot for regulator export).

Four edge types connect nodes: derived_from, applies_policy, approved_by, exports_to. Each edge carries a signature over the canonical JSON representation of the endpoints plus the edge metadata. Two additional edge types (discloses, finds) are reserved for disclosure-composer and Judge-agent outputs respectively.

One Merkle-root chain binds ledger events at daily granularity; one machine-readable disclosure block per region per artefact captures the disclosures applied under each jurisdictional policy pack. The PDF and Word outputs are deterministic renderings of the canonical JSON-LD an auditor verifying the PDF is verifying the same bytes as an auditor verifying the JSON-LD.

The specification is open for comment for forty-five days after v0.1 publication. Version roadmap targets v0.5 on Article 50 enforcement day (2 August 2026, with the IAB plenary presentation), v0.7 in November 2026 with the C2PA interop demo, and v1.0 in February 2027 with the IAB Tech Lab standards-contribution recognition submission.

The engineering reason for publishing the spec before the product's general availability is that a closed-format Evidence Pack is a retention hook, not evidence. The commercial reason is that a Deputy General Counsel will not buy a format only the vendor can read. The strategic reason is that standards belong to the category; authority belongs to the author; the trade is correct for both the buyer and the vendor.

The three diagnostic questions

A Deputy General Counsel talks to many vendors in 2026. Three questions separate real cross-vendor provenance from marketing claims. The questions are worth rehearsing at the level of exact wording, because the wording produces the answer.

Question one: "Show me the signature on an intake from Canva." The asset originates outside the vendor's toolchain; it is unsigned upstream; the graph has to provide the signature. A real answer names the content-hash algorithm (SHA-256), the signing-key management (AWS KMS or equivalent HSM-backed), and the specific provenance fields that enter the graph on intake (content hash, source-system identity, authenticated user identity, timestamp, intake path). A marketing answer is "we use industry-standard cryptography" or "we support Content Credentials."

Question two: "Show me the independent verification." Hand the Evidence Pack JSON-LD from a synthetic campaign to an AmLaw-50 partner, a cyber-insurer, or a peer firm's compliance team. Ask them to verify the signatures without calling the vendor. A real answer ships a Python reference validator as open source, with a conformance test suite, at a stable URL, under a permissive licence. A marketing answer is "you can trust us" or "third-party audit."

Question three: "Show me the portability SLA." If the buyer exercises the data-portability clause on day 547 of the contract, what leaves the graph, in what format, and on what timeline? A real answer hands over open-format JSON-LD plus signing certificates plus a migration runbook inside a named service-level agreement with a specific elapsed-time commitment. A marketing answer hand-waves or offers "standard export."

Every Deputy General Counsel who has done one round of this questioning has developed muscle memory for the right answers. Every Deputy General Counsel who has not will learn through a procurement process that takes longer than the Article 50 enforcement window permits. The questions above are not adversarial; they are the minimum evidentiary bar. A vendor that cannot clear them is a vendor whose Evidence Pack will fail the first outside-counsel review.

What is honest at T0

Every technical architecture described above is buildable. Most of the primitives are built. Some are in active engineering; the rest are on a dated roadmap. Honesty discipline belongs on this section specifically.

SOC 2 Type I is in progress; Type II is on the roadmap for Q1 2027. ISO 27001 follows on the same window; ISO 42001 sits in Q2 2027. The EU data-residency tenant in the Dublin region is required before any first Dublin-subsidiary deployment and is architected for day-one availability; the first deployment validates it. The cyber-insurer partnership for the shared-responsibility rider is in negotiation with a Chubb-, AIG-, or Beazley-class underwriter; a signed rider is the commercial gate before first paid enterprise contract. The AmLaw-50 partner co-authoring the financial-services policy pack is in an engagement, not a signed client alert; the naming of the firm on an alert is a gated milestone.

The Evidence Pack open specification is published at v0.1. The reference validator is in beta. The IAB AI Transparency and Disclosure Working Group contribution is active. No regulator has yet validated the format; the goal is recognition as standard, and recognition is a year or two of patient standards-body work, not a press release.

One US FS design partner is in pilot. Two more are in scoping. Cycle-time compression from eleven days to under forty-eight hours on routine artefacts, Evidence Pack assembly under one minute, cross-vendor completeness above ninety-five percent all are design-partner pilot targets, validated per contract, not shipped-customer references.

The imperfect parts are imperfect by design. Detection models have false-positive rates; every one of ours is published with its rate in the README. Policy-pack rules capture the state of regulatory interpretation as of the last AmLaw refresh; the 72-hour break-glass refresh cadence is the escape valve. A buyer who asks "is this a finished product" is asking the wrong question. A finished product at a moment when the category is still being defined is a product that will be obsolete the day the category moves. The right question is "is this the engineering posture that will earn the IAB working group's recognition in 2027 and the regulator's acceptance in 2028." That posture is what this piece describes.

What changes when the bridge is real

Three consequences at the architectural layer worth carrying out of this piece.

Single-vendor provenance stops being a defensible compliance posture. Any firm whose 2026 provenance strategy rests on Content Credentials alone will see that strategy fail its first cross-vendor audit under Article 50. The failure is not Adobe's fault; Adobe did correct work. The failure is a design decision that picked one vendor where the regulation required many. Firms scoping procurement in Q3 2026 that still treat "we have Content Credentials" as sufficient will revisit the posture in 2027 renewal, with a year of accumulated compliance debt behind them.

The ecosystem agentic clouds become additive, not substitutive. The vendor conversation in 2025 was "Salesforce or Adobe or a pure-play." In 2026 it is "Salesforce and Adobe, under a stack-neutral layer that signs across the seam." Every buyer who internalises this framing stops treating new-vendor pitches as migration conversations and starts treating them as additive-layer conversations. The procurement gate falls; the time-to-pilot shortens; the commercial conversation shifts from "which ecosystem do we move to" to "which layer do we add on top."

The open specification becomes the interchange format. Whichever Evidence Pack format earns IAB Tech Lab recognition first becomes the 2027 and 2028 interchange format for regulator-addressable audit in marketing. The format the IAB recognises is the format auditors train against, the format cyber-insurers underwrite against, and the format successor vendors read. Standards-body work compounds; every published contribution, every working-group call, every co-authored addendum is a stronger moat than a feature release, because standards outlive product iterations.

The ceiling on this category is where the axis swap thesis predicts it should be: stack-neutral, compliance-first, cross-vendor by construction, contractual shared responsibility backed by carrier-underwritten insurance, Evidence Pack as an open-specification standard in the IAB ecosystem, and a policy engine co-authored with AmLaw-50 firms on an exclusive-per-vertical basis. The floor on this category is where the honesty discipline puts it: pre-paying-customer, one pilot in flight, SOC 2 Type I in progress, an open specification at v0.1, a cyber-insurer in negotiation. The distance between floor and ceiling is the sixteen weeks between today and Article 50 enforcement, and the next eight quarters of patient standards-body and carrier-underwriting work.

Further reading on our domain

• The axis swap: compliance throughput is the next martech bottleneck the category argument underneath this architecture. Why the basis of competition moved from content throughput to compliance throughput in Q1 2026 and what the 2x2 quadrant structure says about why incumbents cannot win on the new axis.
• EU AI Act Article 50: the 16-week readiness runway for US firms with an EU subsidiary the four-milestone runway (map creative sources, run the retrospective scan, deploy the policy pack, sign the shared-responsibility clause) for a regulated financial-services firm scoping Q3 2026 procurement.
• The Evidence Pack open specification the JSON-LD schema, the reference validator, the five node types, the four edge types, the Merkle-root chain, the three signed formats. Contributed to IAB Tech Lab and C2PA working groups.
• The artefact graph the write-once, append-only, typed node and edge store that binds every campaign object across Salesforce Marketing Cloud, Adobe GenStudio, Canva, Figma, Workfront, and external-agency outputs into one chain of custody.
• Stack-neutral integrations native Salesforce Marketing Cloud exporter at MVP, Adobe GenStudio next, HubSpot and ad platforms Year 2. Stack-neutrality as a contractual commitment, not a slogan.
• Book a 20-minute evaluation a founder-led call. Bring one of your own campaigns from the trailing ninety days; we walk the chain rebuild in front of you and generate the Evidence Pack on-screen.