media_provenance_rights v1.0.0

name: "media_provenance_rights" description: "Handle provenance and rights for generated media: C2PA Content Credentials basics, likeness and voice consent records, source asset logging, and platform and client disclosure decisions. Use when generating, editing, or shipping AI images, video, or audio, when a real person or voice appears, or when a client or platform asks how a file was made."

Purpose

Ship generated media with a record that answers three questions without guessing later: where did this file come from, who gave permission for the people and inputs in it, and what disclosure did the audience get. Provenance is not the same as permission, and a label is not the same as a licence. This skill keeps those three jobs separate and logged.

Workflow

1. Open the rights log before generating. Copy templates/rights-log.csv to the project folder and add one row per final asset, not per prompt batch. Run the validator early with python3 bin/rights_check.py rights-log.csv so missing consent shows up before the edit locks.
2. Log provenance at creation. Record the tool and version, the model if the tool names one, the date, the operator, the prompt or capture source, and every input file used. Record human contribution in plain words: selection, arrangement, edit, compositing, retouch, script change. See references/provenance-and-disclosure.md for what C2PA captures automatically and what it never captures.
3. Preserve Content Credentials, then verify the final file. Export from a C2PA-aware tool without stripping metadata, keep the unconverted master, and check the exported file, not a screenshot of a panel. Use Content Credentials Verify on the web or c2patool <file> and c2patool <file> --detailed locally if installed. Log the result as present and valid, present and invalid, absent, or stripped on export. A missing credential proves nothing on its own, and a valid credential proves a signer made a claim, not that the claim is true.
4. Clear likeness and voice before use. For any recognisable person, face, or voice, including a simulation a viewer or listener can still place, get written consent that names the use, the media, the territory, the term, paid use, and whether a digital replica or voice model may be made and reused. Work through templates/consent-record.md and references/consent-and-licences.md. No consent on file means the asset is blocked, even if the generation tool allowed the prompt.
5. Clear every input separately. Music, stock, fonts, logos, artwork, client files, and reference uploads each keep their own licence terms. Check that the licence covers the actual use: commercial or client work, paid advertising, territory, term, platforms, and derivative or AI processing if the input was fed to a generator. File the invoice, licence text as it stood on the day of use, and any release forms next to the log.
6. Make a disclosure decision per platform and per client. Decide from the final asset, not from how much AI was used in the process. Realistic generated or meaningfully altered people, places, events, or voices trigger disclosure on YouTube, TikTok, and Meta. Advertising adds a second, separate duty: disclose a material connection and, where a synthetic performer endorses a product, disclose that the performer is synthetic. See the decision table in references/provenance-and-disclosure.md.
7. Run the release gate. Run python3 bin/rights_check.py rights-log.csv --strict on the final log. Fix every BLOCK, explain every WARN in the notes column, get a named approver and date in the log, and only then publish. Hand the client the final file, the disclosure wording used, and a copy of the log rows for their assets.

Output Contract

• A completed rights-log.csv with one row per shipped asset, covering provenance, consent, input licences, C2PA status, disclosure decision, and approver.
• A signed consent record for every recognisable likeness or voice in the shipped assets, filed with the log.
• The disclosure actually used on each platform, copied into the log, plus the platform label if the platform applied its own.
• A validator report with zero BLOCK items. Warnings stay only when the notes column gives a reason a reader can check.

Operating Rules

1. Never treat a valid C2PA credential as proof that the content is true, licensed, or consented. It proves a signed claim about history and that the file has not changed since the last signature.
2. Never treat a tool plan, a prompt box tick, or a platform label as a licence or a consent. Rights come from the rights holder, in writing.
3. Never ship a recognisable likeness or voice without written consent on file. Verbal yes, a public social profile, and the person being famous are not consent.
4. Never use a fabricated testimonial, review, or endorsement, labelled or not. Disclosure does not cure an invented customer experience.
5. Never strip metadata to avoid a label. Stripping provenance to dodge disclosure is a policy violation on major platforms and destroys the record a client dispute will need.
6. If a fact about a law, a platform rule, or a licence cannot be checked against a primary source at the time of the job, mark it as unchecked in the log and do not state it to a client as settled. Platform rules and AI laws change often, so recheck at publish time.
7. This skill is a working method, not legal advice. For broadcast, national advertising, a deceased person, a minor, or a disputed claim, stop and get a qualified lawyer in the relevant place.