A content provenance report shows, passage by passage, which parts of a published piece were said verbatim by its author, which were rooted in what they said, which were generated, which were sourced, and which drew on their Riff Profile.
A badge asks you to trust a claim. A report shows its working. Riff drafts long-form writing from an author’s own voice notes, so the honest question a reader can ask is: how much of this did the author actually say? A creation record, which is Riff’s name for a content provenance report, answers that per piece, with the thresholds that produced the answer printed on the page so anyone can disagree with them.
Every stretch of a measured piece falls into exactly one of these. The first two are the author’s own.
The approved text of the piece is compared with the transcripts of the voice notes that produced it. Both are normalised the same way for matching only (lower case, contractions expanded, quotes and dashes unified, filler words dropped from the transcript), and the comparison looks for runs of consecutive words the two share, longest first, so that a passage the author moved still matches.
Thresholds in method version 3: a run counts as verbatim from 6 consecutive words containing at least 2 content words (function words alone never qualify); a shorter run from 4 words, or a stretch whose content words appear in the transcript at 50% or more, counts as rooted; a run of 6 words shared with a source Riff retrieved while researching counts as sourced; everything else is generated.
The record states these thresholds on every page. The headline figure, the author’s share, is the verbatim and rooted words divided by all the words in the piece. Sourced words are not part of it, and neither inflate nor deflate it. Verbatim and sourced are facts; rooted and generated are separated by a threshold, and the record says so.
Sourced is decided by a shared run alone, never by an overlap judgement. Nothing in a finished piece points back to a source, because Riff credits a source by name in the prose rather than by link, so a stretch has to share real consecutive wording with something Riff retrieved before the record will call it sourced. Where the author said the same thing themselves, the transcript wins: it is their sentence, whoever else has written it. A piece drafted before Riff began recording its research has no sources to compare against, and its record says sourced was not measured rather than reporting zero.
The transcript is locked: the record carries a SHA-256 hash of the transcript texts, in question order, joined by a newline, so a later reader can check that the words compared are the words recorded. Timings inside the recording are not captured in this version.
Word matching misses text that is the same as a source with small changes: a different tense or plural, a swapped synonym, a sentence split or joined. So after the code’s first pass, a second, stemmed word-matching pass runs in plain code, and whatever is still labelled generated is then reviewed by a language model, which may upgrade a stretch to verbatim, rooted, profile or sourced when it can point to the specific words in the source it came from.
The second check can only add credit, never remove it, and being a model, its judgement can vary between runs; the result is measured once and stored, and the record keeps the model and prompt version that produced it. Every passage it credited carries a visible mark, and every credit stores the real span it was traced to. Profile words count toward the author’s share, because the profile is built from the author’s own onboarding answers and approved by them; sourced words stay in the total without raising or lowering the share.
It evidences how the piece was made. It does not certify that anything in the piece is true, and it is not a defence against AI detection tools, which measure something different and unreliably. If the author edits the piece after approval, the record measures the approved text and says how many words were changed afterwards; their edits are their own authorship and are not reclassified.
C2PA content credentials are machine-readable, signed manifests that travel with a file. A creation record is the human-readable companion: the same underlying facts, laid out for a reader. The categories here follow the spirit of the IPTC digital source type vocabulary that C2PA uses, and the record is designed as a versioned data structure first so a signed manifest can draw on it later.
Riff, a voice-first writing tool for newsletters and long-form articles, made by Idea Junkies in the North East of England. An author who writes with Riff can publish the creation record for any finished piece; each public report binds their name to that piece of writing and shows what provenance means in practice. About Riff