Abstract
When AI participates in writing, a contribution record can fail in two opposite directions. It can be too thin to support a later correction, reconstruction, or review; or it can be so exhaustive that private drafting becomes a durable surveillance archive. This paper introduces proportional provenance: a record whose event detail, visibility, retention, redaction, and expiry are fitted to an identified accountability purpose rather than to total process capture. The paper offers a Contribution Record Protocol that records accountability purpose, contribution event, human/machine relation, granularity, audience/access tier, retention horizon, redaction or expiry rule, verification source, reconstruction limit, and non-conclusion. The protocol does not determine authorship, quality, or responsibility. Its task is narrower: to make a selected relation reconstructable for a stated interval without pretending that the record contains a complete account of how a work came to be.
1. The correction request after the clean-up
A community research team publishes a public report on neighborhood air monitoring. The report combines sensor readings, interviews with residents, a literature review, and a short section explaining how the team interpreted gaps in its data. The writing process was ordinary in a familiar sense and complicated in a newer one. The team used an AI assistant to generate several outline alternatives at the beginning of the project. Two human writers chose none of them intact, but used one as a way to reorganize a section. A research assistant later inserted a qualified sentence about a measurement limitation. An editor moved that sentence into a footnote while streamlining the public summary. Confidential interview notes remained in a restricted folder. A final editor made a late wording change before release.
Six weeks after publication, a reader sends a precise correction request. The report’s public methods section says that a gap in monitoring “does not affect the conclusion.” An earlier internal version had said that the gap “may limit the conclusion’s applicability to evening traffic patterns.” The reader does not ask who authored the report. The reader asks what happened to the qualification and whether the final sentence can be supported.
The team opens its project folder. There is a final PDF, a final editable file, and a general note stating: AI assistance was used during draft development. The note is true. It is also useless for the question at hand.
The team had a short internal contribution record once. It identified that four outline alternatives had been generated; that human writers reorganized the section; that a qualification was added during evidence review; and that confidential resident notes were not preserved in the contribution trace. The record also linked to a restricted version history. During a routine “clean-up,” however, the entire contribution log was deleted along with temporary exports. The team had wanted to reduce the amount of private material it retained. It had succeeded, but without distinguishing the confidential interview content from the small amount of process evidence needed to reconstruct a material public change.
Now the correction editor faces a false choice. One response is to say that the record is gone and that nothing can be known. The other is to decide that the team should have retained every prompt, output, comment, draft, and source note forever. The first response makes correction dependent on memory. The second turns writing into an archive of everything that crossed a screen.
Neither response is adequate.
A final text is not a record of every relation that produced it. A generic AI-use statement is not a record of which material event mattered to a later question. And a full activity log is not automatically a responsible answer. It may hold confidential material, reveal a source’s identity, expose an abandoned line of inquiry, preserve a private disagreement beyond its useful life, or make ordinary drafting newly searchable by people who never needed to see it.
The problem is not whether the team should have a “provenance system.” It is what kind of contribution record the correction request actually requires. Does the editor need the complete early outline conversation? Does the reader need access to confidential interviews? Does the team need to reconstruct every keystroke? Or does it need a smaller relation: that a human evidence reviewer added a qualification on a stated date; that a later public-summary edit removed or relocated it; that a named internal version can corroborate the sequence; and that the record cannot tell us why any person preferred the final wording?
This paper calls that design problem proportional provenance. The phrase is deliberately conditional. A contribution record is proportional only to a named purpose. A record appropriate for a correction inquiry may be inappropriate for public display. A record appropriate for a short editorial review window may be excessive after the issue is resolved. A trace that preserves a connection between an output and a revision may be insufficient for a scholarly archive, yet too revealing for a confidential source file.
The order matters. First name the later question. Then ask which event must be reconstructable. Then decide what evidence, access, retention, redaction, and expiry that question requires. Logging comes last.
2. A trace is neither a verdict nor a complete memory
Technical provenance is often discussed as if it could settle an argument by itself. It cannot. The C2PA technical specification describes a provenance structure built from assertions, a signed claim, and a manifest associated with an asset. It treats provenance as an account of an asset’s history of interactions with actors and other assets, and permits information about actions or AI disclosure to be asserted.[1] Its own guiding principle is more cautious than many public conversations: a validated set of provenance assertions should not be taken as a judgment that the content is “good” or “bad.”[1]
That boundary is essential. A technically bound record can tell a reviewer that a claim was associated with a particular asset under a stated trust model. It cannot tell the reviewer whether the asset is true, whether a human understood an output, whether a sentence is persuasive, whether a contributor intended a particular meaning, or who should be credited as an author. It can make a claim inspectable. It does not complete the judgment that follows.
The National Telecommunications and Information Administration draws a similarly useful distinction. Its account describes provenance as the origin of data or AI system outputs and authentication as a way of establishing provenance through verifiable assertions about origin.[2] It also warns against two tempting conclusions: authenticated content is not necessarily true, and the absence of provenance or authentication information does not itself establish where content came from.[2] A missing trace may result from a deletion policy, an incompatible system, a private workflow, or an unrecorded action. It is an absence in a record, not proof of a hidden origin.
The correction request in this paper therefore has a modest aim. It does not need a total history of the report. It needs a defined relation to be reconstructable: the history of the disputed qualification, the human and system actions relevant to its movement, a route to corroborating evidence, and an account of what has been intentionally withheld.
That is not complete memory. It is a designed record with a purpose, a boundary, and an expiration problem.
3. Purpose comes before capture
A team cannot choose a responsible record merely by asking what a tool can export. It must first name the later question that a record is expected to answer. A sentence-level correction, an internal editorial review, an archive’s account of a work’s production, and a request to show that a confidential source was protected may all refer to the same report. They do not require the same record.
Records-management guidance offers a useful, limited analogy. NARA describes a lifecycle that includes creation or receipt, maintenance and use, and disposition. It also frames appraisal as a process that evaluates content, context, and function in order to determine final treatment rather than presuming that every record is permanent.[3] [4] That is federal-agency guidance, not a rule for writers, publishers, or collaborators. The transferable lesson is smaller: a record’s fate may depend on the purpose it serves, not just on the fact that a system can preserve it.
Consider four distinct purposes for the report team.
| Later purpose | What a reviewer needs to reconstruct | What is not necessarily needed | Risk if the record is too thin | Risk if the record is too broad |
|---|---|---|---|---|
| Correction inquiry | Whether a material qualification was added, moved, removed, or changed; which approved version can corroborate the sequence. | Full prompt text, every abandoned outline, or confidential source notes. | The team cannot explain a material public change. | Private drafting becomes available to people resolving a narrow issue. |
| Internal editorial review | The relation between an assistance event, a human revision, an evidence check, and final approval. | Public access to internal comments or confidential inputs. | An editor cannot distinguish a record of event from a vague assertion that “AI was used.” | Routine feedback becomes a permanent performance record. |
| Limited scholarly or archival account | A declared method for identifying material human–machine contribution events and preserving a small evidentiary sample. | Every intermediate draft or private deliberation. | Future interpretation relies on a final artifact with no account of material process. | The archive captures sensitive or irrelevant work that should not travel forward. |
| Confidential-source protection | That the source material was excluded, redacted, or access-restricted and what alternative evidence may support the public claim. | The source’s identity or the full private notes. | A reviewer cannot tell whether a privacy safeguard existed. | The record defeats the safeguard by reproducing protected material. |
The table does not produce a rule such as “retain summaries for six months.” It does something earlier and more valuable. It makes the accountability purpose expressible. Without that step, a team will usually make one of two mistakes: it will save everything because storage is easy, or save nothing because deletion sounds prudent.
The same intervention can have different record value at different moments. The four AI-generated outline alternatives in the constructed report may matter very little to a later correction about a measurement qualification. A later researcher interested in how the report’s public form developed might find them more relevant, but still not need the original instructions, all generated text, or the team’s unrelated private planning. The appropriate design changes with the stated question.
This leads to a practical discipline:
Do not retain a contribution event because it exists. Retain a bounded description because a named future question may require it.
The discipline also makes absence legible. If a team decides not to retain raw interactions, it can record the decision and its rationale at a much lower level of detail: Raw AI interactions were not retained because they could include confidential materials; a contribution-event summary and a restricted version identifier were retained for correction review through the stated review horizon. That statement does not prove that the team made wise choices. It does keep a later reviewer from mistaking silence for a complete lack of process.
4. Granularity, access, and time are separate dials
Once a purpose is named, a team still has three independent design decisions to make. They are often collapsed into a single question about whether a log is “on” or “off.” That collapse is the source of much bad record design.
Granularity: how much of the event?
A trace can be narrow or expansive. At one end, it might say only: AI assisted planning. At another, it might preserve every system input, output, revision, time stamp, and interaction metric. Between those poles lie useful middle forms: an event summary; a record that four outline alternatives were generated and not used verbatim; a version identifier marking a human-added qualification; a reference to a verification note; or an indication that a confidential material class was excluded.
More detail is not automatically more explanatory. A raw transcript may record words without revealing why an editor accepted a suggestion. A short event summary may hide a material difference. The appropriate level is the least description that allows the named purpose to be examined. It should always be paired with a reconstruction limit—a sentence that says what the summary cannot reveal.
Access: who can see which layer?
A contribution record may have several access layers. A correction editor may need a concise internal event relation. A public reader may need only a corrected sentence and a linked notice. A restricted reviewer may need access to a version identifier but not the version’s confidential attachments. An archivist may receive a redacted account after a specified interval. A system administrator may need no access at all.
These distinctions matter because access is not merely a technical permission. It is a decision about what relation a particular audience needs to see. The paper does not declare that every work requires a public AI label, nor that internal evidence should be hidden from a correction process. It asks the more constrained question: who must be able to inspect this event to answer this purpose, and what must remain unavailable to them?
DraftMarks provides a concrete but limited example of how process traces might be made interpretable without showing a raw interaction transcript. The research record describes an augmented reading tool that uses writer–AI interaction data to compute collaboration metrics and visual writing traces, in part because summary metrics and simplified provenance can fail to express the process.[7] The study does not show that any particular visual encoding tells the truth about a writer’s labor. It does demonstrate that a trace can be rendered for a reader rather than simply dumped as activity data.
Time: when should the event stop being retained?
Retention is not an afterthought to capture. It is part of the record’s meaning. A contribution event needed to respond to a correction during a live review period may not need to persist indefinitely. A small record needed for an archive may be retained under different conditions than a restricted editorial note. A confidential source may require that the trace itself contain no source text and that the trace’s access route expire after the issue is resolved.
The ICO’s AI guidance says that, where personal data are involved, teams should document movements and storage of that data in order to apply controls and maintain audit trails; it also says that intermediate files containing personal data should be deleted once they are no longer required.[5] Its storage-limitation guidance says that retention should be connected to a specified purpose, documented where possible, reviewed, and not continued indefinitely “just in case”; it distinguishes taking data offline from true deletion or anonymization.[6] These are regulator statements in a particular legal setting and are under review. They do not tell a writing team what duration to use. They do clarify why a duration with no stated purpose is not a neutral default.
The three dials must be set together. A richly detailed record may be appropriate only with tightly restricted access and a short review period. A public correction notice may be intentionally brief but retained long enough to make the status of a published work clear. An internal event summary may be enough for an editor, while a redacted archival note preserves a future research question without exposing source material. There is no universal setting; there is a design relation.
5. The Contribution Record Protocol
The Contribution Record Protocol is a teaching instrument for a publishing-platform steward, managing editor, digital archivist, editorial-policy lead, or educator. It is applied to one material contribution event after the team has named a later purpose. It does not rank a system or decide whether a person is an author. It is a record-lifecycle design sheet.
| Field | Reader records | Why it matters | It does not decide |
|---|---|---|---|
| 1. Accountability purpose | The later question this record must answer. | Stops logging from becoming its own purpose. | Whether the purpose is legally sufficient. |
| 2. Contribution event | A bounded event, such as outline alternatives generated, a sentence revised, or a correction request received. | Makes the unit small enough to govern. | Every prior or future action. |
| 3. Human/machine relation | What each participant did in relation to the event. | Separates system suggestion, human revision, approval, and verification. | Authorship, intent, or responsibility. |
| 4. Granularity | The minimum descriptive level retained. | Distinguishes role labels, event summaries, selected outputs, and raw traces. | That more detail is always better. |
| 5. Audience/access tier | Who may see which part of the record and through what route. | Separates internal correction access from public visibility. | A public-disclosure obligation. |
| 6. Retention horizon | The event or date that triggers review, retention, transfer, or expiry. | Makes time a design variable. | A universal retention term. |
| 7. Redaction or expiry rule | What will be removed, masked, anonymized, or deleted, and when. | Makes privacy protection specific rather than rhetorical. | That data have been permanently erased in every copy. |
| 8. Verification source | What separate artifact, person, version, or evidence can corroborate the entry. | Prevents a log from being self-authenticating. | That the source proves truth or intent. |
| 9. Reconstruction limit | What a later reviewer still cannot learn from the record. | Keeps the trace honest about omission. | That the absent fact never existed. |
| 10. Non-conclusion | The judgment the record cannot make. | Prevents provenance from becoming an authorship or quality test. | Any ultimate claim about the work. |
The order of the fields matters. A team does not begin by selecting a database column. It begins with the accountability purpose. An entry without a purpose is likely to become either an orphaned surveillance trace or an empty compliance label. A contribution event without a granularity decision will slide toward raw capture. An access tier without a retention horizon can become a silent permanent archive. And a record without a reconstruction limit asks later readers to infer more than it can support.
The protocol also creates a modest but important distinction between a record of a relation and a record of a life. A record of a relation might say: On 8 March, a human evidence reviewer added a qualification after examining sensor coverage; a later editorial revision moved it from the public summary into a footnote; the restricted version history can corroborate the sequence; the contribution record does not contain the confidential interviews, the reviewer’s private notes, or a claim about why the final wording was preferred. A record of a life would attempt to preserve every input and thought around the report. The former may support an identified correction purpose. The latter may simply accumulate power over private work.
6. Worked design: the disputed qualification
The following worked record applies the protocol to the constructed report. It does not state whether the public sentence was correct. It does not identify an author of the disputed wording. It decides only what a correction editor might need to reconstruct the relevant event.
| Protocol field | Constructed record design | Editorial reading |
|---|---|---|
| Accountability purpose | Respond to a reader’s correction request about whether a measurement qualification was removed from the public methods section. | The question is narrow and material: reconstruct the relation between the qualification and the final public wording. |
| Contribution event | A human evidence reviewer adds a qualification; a later editorial action relocates it during public-summary revision. | The event is not “the whole report was AI-assisted.” |
| Human/machine relation | AI produced early outline alternatives; human writers reorganized; a human reviewer added the qualification; a human editor moved it; no claim is made that the system selected the final wording. | The record distinguishes roles without assigning authorship or intent. |
| Granularity | Retain a dated event summary, a stable version identifier, and a brief description of the movement; do not retain raw prompt/output history or confidential notes. | The trace is sufficient for the stated question only if a separate version can corroborate it. |
| Audience/access tier | Correction editor receives the event summary and version route; public reader receives a correction notice if warranted; confidential-source materials remain unavailable. | A correction record is not a general right of access to private drafting. |
| Retention horizon | Retain through the report’s correction-review period, then review whether a redacted archival summary has a separate purpose. | The horizon is a trigger for review, not an automatic universal term. |
| Redaction or expiry rule | Exclude interview identifiers and raw notes at creation; remove the restricted access route when no longer needed; preserve any public correction relation separately if issued. | Redaction is specified before a sensitive copy can spread through the record. |
| Verification source | Restricted version history and the evidence-review note, accessed by a named internal route. | The contribution record is not asked to prove itself. |
| Reconstruction limit | The record cannot reveal private deliberation, every discarded wording option, all AI interactions, or why a particular editor preferred the final public phrasing. | Omission is declared rather than passed off as nonexistence. |
| Non-conclusion | The record does not establish authorship, truth of the final claim, quality of the report, or any individual’s responsibility. | It supports a bounded correction inquiry and nothing larger. |
This design makes the correction process possible without using private source material as the price of explanation. It also leaves room for an uncomfortable but honest result. The correction editor may discover that the contribution record identifies a moved qualification but does not resolve why the movement was approved. In that case, the team has not failed because its record is incomplete. It has learned the boundary of the record it designed. A further human inquiry may be needed; the protocol makes that need visible rather than concealing it behind a database entry.
7. Preserve the question, not every trace
The argument for privacy-limited records can be misunderstood as an argument for deletion whenever material feels inconvenient. The countercase is important. A trace may be too thin, too short-lived, or too heavily redacted to support correction when a public work needs it.
PLOS’s correction policy offers a public-record example. It distinguishes correction notices, expressions of concern, and retractions; corrections may address errors affecting a work’s understanding or important metadata, and notices are linked to the original publication to document the change.[9] The policy belongs to scholarly publication and should not be copied into private writing. Its narrower lesson is that an update trail can preserve a relation between an original public artifact, a material alteration, and a notice explaining the altered status. A bare replacement file would not perform the same task.
The same principle can guide a contribution record without converting drafts into a permanent archive. If a report may need a later correction process, the team can retain the smallest event relation necessary to identify a material change, the evidence route needed to check it, and the exclusions that protect confidential material. The record can be set to expire after a defined review decision, transferred in redacted form for a distinct archival purpose, or deleted once no stated purpose remains. What it should not do is vanish by accident because it was stored with disposable exports, or persist by accident because no one set a review point.
Data-provenance scholarship similarly treats provenance as a record of origins and processing that may support accountability-related inquiry within larger AI systems.[8] The source does not say that a record creates accountability. It emphasizes that provenance must be tied to the question it is meant to serve. The same restraint applies to writing. A contribution trace is useful only insofar as a reviewer knows what it represents, what it leaves out, and how it can be checked.
8. An action rule for contribution records
A team can use the Contribution Record Protocol in five movements.
- Name the later question. State the correction, review, archival, or confidentiality purpose in one sentence. If no purpose can be named, do not begin collecting a detailed contribution trace.
- Bound the event. Identify a material contribution relation rather than an entire work session: a generated outline set, a human revision, a verification step, a relocated qualification, or a correction request.
- Set the three dials. Choose the least useful granularity, the necessary audience/access tier, and the retention/review/expiry horizon together. Do not decide any of them in isolation.
- Attach a verification route and a limit. Name the independent artifact or person that can corroborate the record. State what private reasoning, missing evidence, or unrecorded relation the record cannot reconstruct.
- Review the end of the record. At the horizon, decide whether the stated purpose remains, whether a redacted form has a new purpose, and what should be deleted, anonymized, transferred, or made inaccessible.
The phrase least useful granularity is intentional. A record should not be maximally thin. It should be just detailed enough to answer the stated question without capturing material that the question does not require. A correction editor who cannot determine whether a public qualification was moved has too little. A correction editor who receives confidential source notes and private draft histories has too much. Proportional provenance is the work of locating the middle, documenting why it was chosen, and admitting where the record stops.
9. What a contribution record cannot settle
The strongest safeguard in the protocol is its final field. A contribution trace cannot tell us who “really” authored a work. It cannot certify factual accuracy, make a system’s output trustworthy, settle a disagreement about intent, determine a person’s responsibility, or prove that a public correction is unnecessary. The first two sections of this paper make this clear technically: verified assertions do not equal value judgments, truth, or a complete origin account.[1] [2]
The final field protects the people inside a record as much as the people outside it. A writer should not be reduced to a sequence of logged events. A system should not become a substitute moral actor because its action appears in a trace. A confidential source should not become legible because a team wants the comfort of complete provenance. And a reader should not be told that a clean record makes a work beyond question.
The correction request in the opening did not require a perfect history. It required a modest reconstruction: what happened to a material qualification, which evidence could check the relation, which materials were intentionally unavailable, and whether the final public record needed an update. That is enough work for a carefully designed contribution record.
What must this record make reconstructable, for whom, until when, and at what privacy cost?
The answer will change across works, institutions, and purposes. The protocol does not solve that variation. It makes the variation accountable before a system converts ordinary drafting into either a blind spot or a surveillance record.
References
[1] Coalition for Content Provenance and Authenticity. C2PA Technical Specification 2.4. 2026.
[2] U.S. National Telecommunications and Information Administration. AI Output Disclosures: Use, Provenance, Adverse Incidents. 2024.
[3] U.S. National Archives and Records Administration. Records Scheduling and Appraisal. Accessed 20 August 2026.
[4] U.S. National Archives and Records Administration. Records Basics. Accessed 20 August 2026.
[5] UK Information Commissioner’s Office. How should we assess security and data minimisation in AI? Guidance under review; accessed 20 August 2026.
[6] UK Information Commissioner’s Office. Principle (e): Storage limitation. Guidance under review; accessed 20 August 2026.
[7] DraftMarks: Enhancing Transparency in Human-AI Co-Writing Through Interactive Skeuomorphic Process Traces. ACM Digital Library, 2026.
[8] Establishing Data Provenance for Responsible Artificial Intelligence. ACM Digital Library, 2022.
[9] PLOS. Corrections, Expressions of Concern, and Retractions. Accessed 20 August 2026.