Watermarks prove an AI wrote the content. Almost nobody is proving what the agent decided, or that the record was not changed afterward. That second half is where the money, the access, and the liability live.
This month Anthropic started watermarking everything Claude generates. Invisible marks in the text, signed provenance metadata on generated files. The EU AI Act pushed it, and it applies worldwide. Google and OpenAI have shipped their own versions of the same idea, and C2PA, the content provenance standard, is now showing up in cameras and creative tools.
This is a good thing, and it is bigger than it looks. Two years ago, "prove where this came from" was a niche worry for a handful of researchers. Now the largest AI labs on earth ship it by default. Provenance is going mainstream.
But watch the exact thing it proves, because it is only half the problem.
A watermark answers one question: did an AI generate this content? That is provenance of the output. It is the right tool when the artifact is a paragraph, an image, or an audio clip, and the risk is that someone passes off synthetic media as real.
It does not answer the question that shows up the moment an AI agent does something instead of writing something. Not "did AI produce this text," but "what did the agent decide, what did it know at that moment, and can anyone prove the record was not edited or backdated afterward?"
Those are different layers. One is about the content. The other is about the decision. And decisions are where the stakes actually are.
The half nobody is proving
Think about what agents are starting to do in production. Approve a refund. Grant access to a system. Flag a transaction as safe. Triage a support ticket into close or escalate. Decide that a document meets a policy. Move money.
Every one of those is a decision with a consequence. And every one of them is currently recorded the same way software has always recorded things: a log.
A log is something you write for yourself. It is trusted the way a diary is trusted, only by the person holding it. Anyone with write access can change it. That is fine right up until the moment someone outside your company asks to see it. A customer dispute. An internal audit. A regulator. A lawsuit. The second a person with real stakes says "prove it," a log file stops being an answer, because the honest response is "here is a file we could have edited, and you will have to take our word that we did not."
That is the wrong side of the burden of proof. Today the team holds the only evidence, and the evidence is a file they control. Proof should be the opposite: something anyone can check, and nobody can quietly alter, including the people who produced it.
What evidence actually means, mechanically
This is the problem we build Etch for, so let me be precise about the mechanism rather than wave at it.
At the moment a decision happens, you sign it. Not a summary written later, the actual decision, with its inputs, captured in the instant. The signature uses a hybrid scheme: Ed25519 today, plus SLH-DSA, the hash based signature standardized as FIPS 205, so the record still verifies in a world with quantum computers.
Each signed record is chained to the ones before it, so you cannot silently drop or reorder events without the chain breaking.
Then the chain is anchored to independent public timestamps. Not a timestamp your own server writes, which you could move, but multiple public calendars that no single party controls. That is what makes backdating impossible. "When" stops being something you can change after the fact, because the proof of "when" lives outside your systems.
The payoff is the part that matters: anyone can verify the record later, offline, with an open source verifier, without access to your infrastructure and without trusting you. If a single event was changed, added, or backdated, verification fails. The record does not ask to be believed. It can be checked.
That is the whole difference between a log and evidence. A log says trust me. Evidence says check me.
Who actually needs this, and who does not
Being honest about scope matters, because "sign everything" is bad advice.
If your agent summarizes documents, drafts copy, or answers questions, you probably do not need signed evidence. A watermark on the output is the right and sufficient tool.
You start needing it the first time an agent decision carries money, access, or liability, and the first time someone with a reason to doubt you asks you to account for it. Fintech. Healthcare. Security and access control. Anything heading for an audit or a customer security review. The test is simple: would a wrong call cost real money, access, or trust? If yes, "here are our logs" will not hold.
Where this is, honestly
I would rather tell you exactly where this stands than oversell it.
You can try it today. Point an MCP client at the hosted endpoint at etch.systems/mcp and your agent writes to a real signed chain while it works, with no signup and no install. The verifier is open source and MIT licensed, so you can check any record yourself without trusting us. Right now one design partner runs it in production, and we dogfood it on our own agents. It is early and pre-revenue. I am not going to pretend there is a stampede. I am telling you the primitive works and it is live.
The pattern
Watermarks were the first mainstream move toward a world where digital things can prove their own origin. That is real progress, and it validates the whole direction.
But content is the easy half. It is static, and one party made it. A decision is harder: it happens in a moment, it depends on what was known right then, and the party who made it is exactly the party you cannot fully trust to describe it later. That is the half still waiting to be solved, and it is the half that shows up in court.
The industry is going to get there, one layer at a time, because the pressure is the same pressure that produced watermarks: things that matter should not have to be taken on faith. Watermarks are content. Decisions are next.
If an agent in your stack made a call that mattered last week, the question is not whether you logged it. Everyone logs. The question is whether you could prove it to someone who has every reason to doubt you.
Etch is at etch.systems. You can verify a record yourself, without an account.
Top comments (0)