If proving human involvement requires continuous surveillance of the human, we have solved the wrong problem.

There is an uncomfortable direction hiding inside the conversation about AI provenance.

People want to know whether a work was made by a human.

Fair enough.

So we begin imagining ways to prove it.

A fingerprint at login.

A face scan.

A heartbeat.

Keystroke patterns.

Stylus pressure.

Mouse movement.

Eye tracking.

Device telemetry.

Location.

Timestamps.

Continuous liveness checks.

Revision history.

Perhaps even physiological signals from a wearable.

Individually, each can sound reasonable.

Together, they produce something much stranger:

in order to prove that the human remained important, we turned the human into the most heavily monitored component in the system.

That cannot be the answer.

The machine became opaque, so we made the human transparent

There is an irony here.

Many of the strongest criticisms of contemporary AI concern opacity.

We often do not know exactly why a model produced a particular output.

Training data may be difficult to inspect.

Commercial systems may reveal little about their internal processes.

Generated media can appear without a visible creative history.

And our proposed solution to this opacity sometimes becomes:

record more about the person.

The model remains largely inscrutable.

The creator gets a biometric dossier.

That is backwards.

If human involvement matters, provenance should protect human agency.

It should not make privacy the price of being recognised as human.

Presence is useful. Surveillance is not.

There are legitimate reasons to establish that a human was present during part of a creative process.

A secure system may need to establish that the authorised creator signed a revision.

A publication may want evidence that a person approved a final release.

A high-assurance workflow may require proof that a particular session involved a verified user.

None of these requirements necessarily imply continuous observation.

There is a profound difference between:

A verified user approved this artifact at 14:32.

and:

Here is everything the user’s body, computer and behaviour did between 09:00 and 14:32.

The first is an attestation.

The second is surveillance.

A good provenance system should know the difference.

Collecting evidence is easy. Knowing when to stop is harder.

Modern devices can observe enormous amounts of behaviour.

A writing application can know how quickly someone types.

A drawing tablet can measure pressure and movement.

A phone can confirm biometric authentication.

A watch can detect motion and physiological changes.

A computer can record application activity, window focus, file changes, clipboard actions and network events.

Technically, these streams could be correlated.

That does not mean they should be.

The engineering temptation is predictable:

one signal might be spoofed, so add another.

Two signals might still be ambiguous, so add five.

Five might not prove authorship, so record the whole session.

Eventually the provenance system stops asking:

What evidence do we need?

and begins asking:

What else can we collect?

Those are very different design cultures.

One produces verification.

The other produces surveillance infrastructure.

More data does not necessarily mean more truth

Even maximal monitoring does not solve the deepest authorship problem.

Suppose a system records:

the correct person authenticated;

the keyboard was physically operated by that person;

the person’s heartbeat indicated they were alive;

the computer remained in their possession;

thousands of legitimate keystrokes occurred;

the document changed throughout the session.

What has been proven?

Quite a lot about presence.

Still not thought.

The person could have been transcribing text from another device.

Someone could have dictated the material.

An AI system could have generated an idea before the monitored session began.

A collaborator could have supplied the central argument.

The creator could have spent ten minutes thinking before ever touching the instrument.

Surveillance cannot make epistemological uncertainty disappear.

At some point more data merely produces more intimate uncertainty.

We know more about the person.

We do not necessarily know more about authorship.

OriON should follow a principle of minimum sufficient proof

This suggests an important design principle for provenance systems like OriON:

Prove the smallest claim necessary using the least revealing evidence possible.

If the claim is:

A verified human approved this release

then perhaps a signed user-verification event is sufficient.

If the claim is:

This artifact evolved through authenticated creative sessions

then revision hashes and signed session boundaries may be enough.

If the claim is:

AI was used during the process

then record the relevant tool event or declaration.

If the claim is:

A human made the final decision

then record the approval and authority relationship.

Do not collect a biometric stream merely because biometrics exist.

Do not preserve every keystroke because keystrokes are measurable.

Do not retain someone’s private creative struggle forever simply because storage is cheap.

The fact that something can become provenance does not mean it should.

The private creative process deserves to remain private

Creative work is messy.

Writers type embarrassing sentences and delete them.

Artists make ugly sketches.

Researchers follow stupid hypotheses.

Programmers write terrible code before finding the right architecture.

People swear at their documents.

People abandon ideas.

People change their minds.

People write private notes explaining what they are afraid will not work.

That mess is not an error in creativity.

It is often where creativity happens.

A provenance system that permanently records every intermediate state risks changing the creative environment itself.

Imagine writing while knowing that every abandoned sentence may remain permanently attributable.

Every failed idea.

Every search.

Every pause.

Every emotional note.

Every discarded political thought.

Every private reference.

Every half-formed argument.

At that point provenance begins producing self-censorship.

The system meant to protect authorship starts altering authorship.

A proof does not always need the underlying evidence

This is where privacy-preserving architecture becomes much more interesting than surveillance architecture.

A system may be able to verify something about an event without publishing the underlying private data.

Imagine a secure device verifies that its authorised user successfully completed a liveness or biometric check.

The public provenance record does not need the fingerprint.

It might only need:

user verification succeeded; signed by trusted authenticator; time X.

Likewise, a writing environment might internally observe a legitimate authenticated editing session.

The public record does not necessarily need every keystroke.

It might instead preserve:

authenticated creative session occurred; artifact changed from hash A to hash B; session attestation signed.

That is a radically different philosophy.

SURVEILLANCE

raw human data
      ↓
stored
      ↓
shared
      ↓
trusted


ATTESTATION

private evidence
      ↓
verified locally
      ↓
minimal signed claim
      ↓
trusted

The second architecture asks technology to reveal less.

That should be a feature.

Proof of Life could become dangerous very quickly

This is one reason will.i.am’s .pol idea is such an interesting provocation.

The intention is understandable: if synthetic media becomes increasingly abundant, perhaps people need some way to recognise that a human creative process occurred.

But a badly implemented Proof of Life standard could become terrifying.

Imagine platforms deciding that creators need stronger .pol scores.

A basic account verifies identity.

A premium marketplace requires behavioural telemetry.

A publisher requires continuous device attestation.

A high-value art market begins demanding biometric corroboration.

Insurance companies become interested.

Employers become interested.

Governments become interested.

Eventually creators are told:

If you want the market to believe you’re human, prove it.

That reverses the burden.

Instead of machines being required to disclose synthetic production, humans become responsible for proving their biological legitimacy.

That would be a very strange future.

Human verification can become a new hierarchy

There is also an accessibility problem.

Not every human behaves in the statistically expected way.

A person with a motor disability may type differently.

Someone using assistive technology may generate unusual interaction patterns.

A non-speaking person may create through AAC, eye tracking or mediated input.

An artist may work through an assistant.

Someone with tremor may produce irregular stylus movement.

A blind programmer may interact through tools that look very different from a conventional keyboard workflow.

A person may simply have an unconventional creative process.

If Proof of Life becomes behavioural pattern recognition, the system risks quietly defining:

normal human creativity

and treating everybody outside that template as suspicious.

That would be particularly perverse.

The technology designed to defend humans from AI would begin deciding which humans look sufficiently human.

A human-led provenance system must avoid that trap.

Provenance should record authority, not police embodiment

This is another reason our agency-map idea matters.

We do not need to infer the whole human from telemetry if we can record meaningful relationships directly.

Who originated the project?

Who supplied the source?

Who performed the operation?

Who reviewed the result?

Who approved publication?

Which actions were delegated to AI?

Which remained approval-gated?

These are governance questions.

They can often be answered more cleanly through signed actions and declared relationships than through physiological inference.

For example:

Farah
  role: author
  authority: final

AI model
  role: structural reviewer
  authority: advisory

Image model
  role: reference generator
  authority: none

Publisher
  role: distributor
  authority: publication

That tells us considerably more about agency than a heartbeat graph.

Do not confuse verification with suspicion

There is a cultural question underneath the engineering one.

Why are humans being asked to prove themselves in the first place?

Historically, provenance systems often authenticate objects because valuable objects can be forged.

That makes sense.

But generative AI introduces a strange inversion.

A machine can generate something anonymously and instantaneously.

The human creator may then be expected to produce evidence that they genuinely existed behind their work.

The default suspicion moves toward the human.

That should make us uncomfortable.

The goal of provenance should not be to treat every creator as a potential fraud.

It should be to create a trustworthy chain of claims when those claims matter.

Sometimes no proof is necessary.

Sometimes a simple declaration is enough.

Sometimes a signature is appropriate.

Sometimes strong device attestation may be justified.

Different contexts require different assurance levels.

A personal poem should not require the same evidentiary apparatus as a piece of evidence submitted to a court.

A children’s illustration should not require the same chain of custody as a photograph documenting a war crime.

Provenance needs proportionality.

The body should be the last resort

This gives us another possible OriON design law:

Prefer artifact evidence over behavioural evidence, behavioural evidence over biometric evidence, and biometric evidence only when the claim genuinely requires it.

Start with the work.

Its revisions.

Its sources.

Its hashes.

Its signatures.

Its declared tools.

Its approvals.

Its relationship to earlier versions.

Only move closer to the person’s body when weaker evidence cannot satisfy a legitimate requirement.

And even then, preserve attestations rather than raw biological data whenever possible.

The body should not become the default API for proving human worth.

What OriON should forget may matter as much as what it remembers

Provenance systems naturally focus on retention.

But privacy sometimes requires deliberate forgetting.

Perhaps OriON needs different classes of evidence.

Some records may be public.

Some private.

Some hashed but not stored.

Some retained only for a limited period.

Some disclosed only during a dispute.

Some destroyed after an attestation is generated.

That means provenance architecture needs not only:

What do we record?

but:

Who can see it?

For how long?

Can it be revoked?

Can the underlying private evidence be destroyed while the proof survives?

What happens if the creator dies?

What happens if a device is compromised?

What happens if a government demands the behavioural history?

Those are provenance questions too.

Because the provenance of a person should not quietly become a permanent dossier about a person.

Human-led AI must also mean human-protective infrastructure

We often describe human-led AI in terms of authority.

Humans choose the purpose.

Humans retain responsibility.

Humans can interrupt.

Humans approve consequential actions.

But there is another dimension:

the infrastructure itself should protect the human from unnecessary extraction.

That includes data extraction.

Attention extraction.

Labour extraction.

And now perhaps identity extraction.

A system cannot plausibly call itself human-led while treating the human as an endlessly measurable substrate.

Human authority without human privacy is a very thin form of leadership.

The goal is not to prove that humans are special

We should also resist turning provenance into another culture war.

Humans do not need a cryptographic certificate proving that human creativity is morally superior to machine generation.

AI-generated work will exist.

Human-made work will exist.

Collaborative work will exist.

Some audiences will care intensely about the distinction.

Others will not.

Provenance does not need to decide which category deserves more cultural value.

Its job is simpler.

Make the process legible.

Let creators make claims.

Let systems provide evidence appropriate to those claims.

Let audiences decide what those claims mean.

And protect the people involved while doing it.

Do not turn humans into logs

The instinct behind Proof of Life is understandable.

When machines become capable of producing convincing creative artifacts, people want evidence that a human remained involved.

But we should be very careful about what we build in response.

If the machine becomes harder to distinguish from a person, the solution cannot simply be to make the person infinitely distinguishable from the machine.

We do not need every heartbeat.

Every hesitation.

Every movement.

Every private draft.

Every behavioural signature.

Every moment of someone’s life converted into a database row.

A trustworthy provenance system should be capable of saying:

We know enough.

Enough to establish the claim.

Enough to preserve accountability.

Enough to show the creative lineage.

Enough to distinguish declared human and machine contributions where necessary.

And then stop collecting.

Because if the future of human creativity requires people to live inside permanent forensic recording systems just to prove they created something—

we have not protected humanity from AI.

We have merely made the human the easiest thing in the system to surveil.

---

OriON design principles emerging from this article

MINIMUM SUFFICIENT PROOF
Prove only the claim required.

DATA MINIMISATION
Collect the least revealing evidence capable of supporting it.

ATTESTATION OVER EXTRACTION
Prefer signed proofs to storage of raw private signals.

ARTIFACT FIRST
Prefer evidence from the work and its history before evidence from the body.

PROPORTIONAL ASSURANCE
A poem, a scientific paper and forensic evidence do not require identical proof.

ACCESSIBILITY
Do not define one behavioural pattern as the canonical shape of human creation.

SELECTIVE DISCLOSURE
Different evidence should be public, private, dispute-only or ephemeral.

FORGETTING
Some evidence should be destroyable after the required proof has been generated.

HUMAN PRIVACY
Provenance exists to make contribution legible, not to make the creator transparent.