AI detection asks a question no tool can answer reliably: was this made by a machine? Provenance asks a different, answerable one: how was this actually made? Diff-based text tracking is the technique behind that answer. Instead of pattern-matching a finished document and guessing, it records the writing process as it happens — diffing each version against the last so every span of text carries a label: typed by a human, generated by a model, pasted from somewhere else, or AI-edited. Grammarly built a product on exactly this: Authorship, launched August 14, 2024, categorizes text by origin as you write and can replay the whole document coming together keystroke by keystroke, rather than scoring it after the fact. The C2PA Content Credentials standard, five years in and now emitting manifests for plain-text documents, is doing the cryptographic version — attaching a signed, tamper-evident record of origin and edits to the file itself. And the low-tech version has been sitting in Google Docs and Word the whole time: version history, plus a decade-old extension called Draftback that replays a doc's revision history like a movie, used by half a million people — largely teachers — to watch how a paper was written. This guide explains what diff-based provenance is, how the tools actually work, what such a record can and cannot prove, why it is a fundamentally more honest approach than probabilistic detection, and how a content team can build an authorship trail into its workflow instead of retrofitting one onto a finished file. Provenance is not a lie detector. It is a paper trail — and in the detection era, a paper trail you can show beats a percentage someone else guessed.
AI detection asks a question that has no reliable answer: was this made by a machine? Every detector returns a probability from pattern-matching a finished document, and independent testing keeps finding false-positive rates that climb past twenty percent on plain, technical, and non-native writing — the whole unreliability record is in AI detection tools and the trust crisis. Provenance asks a different question, and this one is answerable: how was this actually made? Diff-based text tracking is the technique that answers it. Instead of guessing from the result, it records the writing process as it happens, diffing each version of a document against the last, so every span of text carries a label — typed by a human, generated by a model, pasted from elsewhere, or AI-edited.
The distinction is the whole point. Detection is an estimate produced after the work is done, by someone who was not there. Provenance is a record kept while the work is being done, by the tools the work was done in. That makes it a different kind of thing entirely: not a verdict to argue with, but a paper trail to show. This guide covers what diff-based provenance is, how the real tools work — Grammarly Authorship, C2PA Content Credentials, and the version history already sitting in your word processor — what such a record can and cannot prove, and how a content team can build an authorship trail into its workflow instead of retrofitting one onto a finished file after a client or a platform asks.
It is worth being precise about why these are opposite approaches, because they are constantly confused. A detector is passive and after-the-fact. It takes a completed artifact, compares its surface features — statistical predictability, even rhythm, the vocabulary tells — against what it learned from training data, and outputs a likelihood. It has no access to how the text came to exist; it is reverse-engineering origin from the finished shape, which is exactly why it misfires on careful human prose that happens to look regular. The full mechanism, and why "spotting AI" is fuzzier than it sounds, is in AI content detection in 2026.
Provenance is active and contemporaneous. It does not analyze the finished text at all; it instruments the act of writing and logs each contribution at the moment it is made. Because it watches the process, it does not need to guess — when a paragraph appears in one instantaneous paste, that is recorded as a paste, not inferred from how the paragraph reads. This flips the reliability problem. A detector's error is structural: probabilistic classification produces false positives by construction. A provenance record's error is different in kind — it can be incomplete or evadable, but within its scope it is not guessing, it is reporting. The trade is certainty-of-method for coverage. Detection covers any text but is unreliable; provenance is reliable about what it saw but only sees text made inside an instrumented tool.
Strip the tooling away and the idea is simple, and familiar to anyone who has used track changes or read a code diff. You take two successive states of a document and compute the difference: what was added, what was removed, what moved. Then you attribute each change to a source based on how it arrived. A steady stream of small insertions and deletions, with pauses and revisions, is the signature of a human drafting. A single large block of clean, finished text appearing at once is the signature of a paste or an AI generation. Text arriving from a labeled AI feature is tagged as AI directly. The sequence of diffs, taken together, is a timeline of authorship — not a judgment about quality, but a record of where each part came from and in what order.
The reason this is more robust than reading the finished document is that it captures information the finished document has thrown away. Once text is final, the history of how it got there is invisible — a human sentence and an AI sentence sit on the page looking identical, which is the exact ambiguity detection tries and fails to resolve. Diff-based tracking never loses that history in the first place, because it recorded each step. The catch, and it is a real one, is that the record lives in the editing environment. The diff timeline is a property of the tool, not of the text, so the moment text leaves the instrumented surface — copied into an email, pasted into a CMS — the provenance does not travel with it unless something re-attaches it. That gap is what the cryptographic approach below is trying to close.
The clearest consumer product built on this idea is Grammarly Authorship, launched August 14, 2024. It does exactly what the section above describes: enabled on a document, it tracks the writing process and automatically categorizes each part of the text by origin — typed by a human, generated with AI, modified with generative AI, pasted from a known or unknown source, or corrected by a spell checker — without attaching a value judgment to any category. The output is an Authorship Report that color-codes the document by source, plus an Authoring Replay that plays the document back chronologically, showing how it came together over time. Grammarly is explicit that this is not detection: unlike a tool that guesses whether AI was involved, Authorship identifies the origin of each part because it was watching as the text was entered. It began as a Google Docs beta in September 2024 and expanded to Microsoft Word.
The honest limitation, and critics have pressed on it, is that recording origin without judging it can also read as neutral cover for AI-heavy work — a report can show a document was largely AI-generated and simply state that, plainly. Provenance describes; it does not approve. That is a feature if you want an honest account and a problem if you expected a purity test. It is the same reason provenance is not a substitute for the content being good: knowing exactly how something was made says nothing about whether it is worth reading, which is the separate discipline covered in how to make AI content not look like AI.
The low-tech version of diff-based tracking has been sitting in Google Docs and Microsoft Word the whole time. Version history logs the document's states over time, and the diff between them is exactly the authorship timeline described above. A decade-old Chrome extension, Draftback, turns that raw history into something legible: it replays a Doc's entire revision history like a movie, letting you watch the text form keystroke by keystroke. It is used by roughly half a million people, largely teachers checking how a paper was actually written. This is provenance you already have, for free, on work done in those editors.
It comes with the sharpest version of the "supporting evidence, not proof" caveat. A version history showing hours of small additions, deletions, and restructuring is strong corroboration of human drafting — that pattern is genuinely hard to fake convincingly. But the same history showing one large paste followed by a few cosmetic edits looks inconclusive at best and suspicious at worst, even when the work is legitimate. And it is evadable: retype AI output by hand and the history will look human. Version history strengthens a case; it does not settle one. Used well, it turns a "prove you wrote this" standoff into a demonstration; used naively, it invites the same false-positive reasoning that makes detection so corrosive.
The most ambitious approach attacks the portability gap head-on. The C2PA (Coalition for Content Provenance and Authenticity) standard, now five years old and several revisions into its Content Credentials spec, attaches a cryptographically signed, tamper-evident manifest to a file — a record of its origin, the tools and edits applied to it, and whether and how AI was involved, all bound to the asset itself rather than living in an editor's database. Content Credentials began in image and video, where it is furthest along, but the manifest format now covers plain-text documents too, which is what makes it relevant here. The signature is what version history lacks: because the record is cryptographically bound and tamper-evident, it can in principle travel with the file and be verified downstream instead of evaporating on copy-paste.
It is early for text specifically, and the honest read is that C2PA solves a different slice of the problem than Grammarly or Draftback. Behavioral tracking records the fine-grained how of a single drafting session; cryptographic credentials record a coarser, signed statement of origin that survives distribution. They are complementary layers, not competitors. The same standard underpins the platform-level labeling now rolling out across social — TikTok's automatic AI labels lean on C2PA Content Credentials, as detailed in TikTok's AI labeling at scale — and the disclosure obligations that make provenance a compliance matter, not just a nicety, are in the EU's AI content labeling law.
Being clear-eyed about the limits is what separates using provenance well from over-trusting it the way people over-trust detectors. What it can do: show process. A complete, natural editing timeline is a strong, concrete answer to "how was this made" — far stronger than arguing about a detector's percentage, because it is a record rather than an estimate, and a reasonable client, editor, or reviewer will accept a demonstrable trail over a black-box score. It also produces an honest internal account: a team that tracks provenance knows exactly how much of its output is AI-drafted versus human-written, which is useful for governance regardless of any external demand.
What it cannot do: prove authorship absolutely, or travel on its own. Provenance only exists where it was recorded — outside the instrumented tool, the trail is gone unless a portable, signed credential re-attaches it, which is still early for text. It is evadable by anyone willing to retype. It says nothing about quality; a fully human document can be bad and a heavily AI-assisted one can be excellent, and the record is silent on both. And it is not a substitute for the deeper strategy: keeping your work defensibly and specifically yours, and building reach across channels no single gatekeeper controls, which is the argument in AI content authenticity in social media. Provenance is one strong instrument in that kit — a paper trail — not the whole answer.
Step back and the reason provenance is gaining ground while detection loses trust becomes clear. Detection asks people to accept a machine's guess about the past as if it were a fact, and the guess is wrong often enough to ruin real work — which is why dozens of universities disabled Turnitin's detector and OpenAI retired its own. Provenance asks a fairer thing: keep a record while you work, and be able to show it. It does not accuse; it documents. It moves the whole interaction from "prove you are innocent of a percentage" to "here is how this was made," which is a conversation a creator can actually win. This is also why the humanizer market is a dead end — relaundering text to beat a scanner treats the scanner's verdict as the thing that matters, when the durable move is to keep an honest account of origin instead. The trust breakdown that detection deepens, and the reframing that provenance enables, run through the AI detection trust crisis and the newsletter-specific version in Substack's AI writing detection.
The direction of the industry backs this up. Platforms are shifting from "can we detect it?" to "is it labeled and does it carry credentials?" — the C2PA-backed labeling on TikTok and elsewhere is a provenance system, not a detection system. That is the tell for where durable trust infrastructure is being built: not on guessing origin from finished artifacts, but on recording origin as content is made and carrying that record forward. A creator or team that keeps its own provenance is aligned with where the whole ecosystem is heading, rather than fighting an unwinnable arms race against classifiers.
The honest framing first. Kompozy is not a provenance product, a detector, or a C2PA signer, and it will not stamp a cryptographic credential onto your files. What it is, is a content engine whose workflow already has the machine-vs-human boundary that diff-based tracking is trying to reconstruct — because in Kompozy that boundary is where the work happens, not something you have to excavate from a finished document afterward.
Here is the concrete mechanic. Every piece of content in Kompozy is generated as an AI draft under a governing Persona Brief, then routed through a per-post human review pipeline before it can publish. That is, structurally, a diff: the model-generated draft on one side, the human-edited, approved version that ships on the other, and the delta between them is precisely the human contribution — the specific number added, the example swapped in, the sentence a person rewrote. A content team, agency, or anyone who has to answer to a client or a compliance rule about how their work is made has that authorship boundary recorded by the workflow itself. Unlike retrofitting Grammarly Authorship onto a Google Doc after the fact, the generate-then-review separation is the native shape of the tool, so the AI-origin-and-human-touch record exists by construction for every post rather than only where someone remembered to instrument it.
And provenance-at-the-document-level only covers text, while a content operation ships far more than text. Kompozy is a generation and multi-platform publishing engine, so the same governed, reviewed pipeline produces net-new formats no doc-level provenance tool touches — Persona Shorts and avatar video, carousels and infographics rendered to exact brand styling, Blog Articles, and Email Newsletters — and schedules them across the eight social platforms plus blog and email on Autopilot. The value for the detection era is that every one of those pieces passes through the same human review gate, so a team keeps a consistent, defensible account of how its content is made across its entire output, not just the documents that happened to be written in an instrumented editor. Provenance is only as useful as it is complete; building the human-in-the-loop step into the engine is how you make it complete. Explore Kompozy to see the generate-review-publish flow.
AI detection tries to answer an unanswerable question — machine or human? — by guessing from a finished document, and it guesses wrong often enough to have lost the trust of the institutions that relied on it. AI content provenance answers a different and answerable question — how was this made? — by recording the writing process and diffing each version so every span of text is tied to its source. Grammarly Authorship does it behaviorally, version history and Draftback do it historically, and C2PA Content Credentials do it cryptographically, each capturing a different layer of the same idea. It is not a lie detector and not a proof of authorship: it only survives inside the tool that recorded it, it can be gamed by retyping, and it says nothing about quality. But it is a record you can show rather than a verdict you have to fight, it aligns with where platform trust infrastructure is actually heading, and — most usefully for anyone producing at scale — it works best when the machine-vs-human boundary is built into how the content is made in the first place, not reconstructed from the wreckage afterward.
Provenance records how a piece of content was made; detection guesses whether a machine made it. A detector reads a finished document and returns a probability — often wrong, because it is pattern-matching surface features. Provenance instead captures the writing process as it happens and labels each span of text by origin: human-typed, AI-generated, pasted, or AI-edited. Detection is a guess after the fact; provenance is a record kept during the fact. That is why provenance is more defensible — it shows the trail rather than estimating from the result.
It means attributing authorship by comparing successive versions of a document — diffing each state against the previous one — so every change is tied to its source. When text appears in one small edit consistent with typing, it is logged as human; when a whole clean block drops in at once, or arrives from an AI feature, it is logged as AI-generated or pasted. The diff between versions is the evidence. It is the same idea as track changes or a code diff, applied to authorship: not "does this look like AI?" but "where did each part come from, and when?"
Grammarly Authorship, launched August 14, 2024, categorizes text by origin as you write and can replay a document being built keystroke by keystroke. Google Docs and Microsoft Word version history log edits over time, and the Draftback extension replays a Doc's revision history like a video. The C2PA Content Credentials standard attaches a cryptographically signed, tamper-evident record of origin and edits to the file itself, and now supports manifests for plain-text documents. Each captures a different layer — behavioral, historical, or cryptographic — of the same provenance idea.
It proves process, not authorship in the philosophical sense, and it has real gaps. Version history that shows hours of small, natural edits is strong supporting evidence of human drafting; one big paste and a few tweaks looks inconclusive or worse. But provenance only exists inside the tool that recorded it — copy text out of a tracked doc and the trail does not follow. It can also be gamed by retyping AI output by hand. Treat it as a paper trail that strengthens your case, not a certificate that closes it.
Yes, and they solve opposite problems. A humanizer relaunders AI text to slip past a scanner, which concedes that the scanner's verdict is what matters and does nothing about the actual record of how the work was made. Provenance does the reverse: it keeps an honest account you can show, so a client or reviewer can see the human contribution instead of arguing about a percentage. One hides origin; the other documents it. In the detection era, a record you can produce is a stronger position than a disguise that has to keep working.
AI content provenance records how a piece of text was actually made — which spans a human typed, which a model generated, which were AI-edited — by diffing document versions rather than guessing after the fact. Grammarly Authorship, the C2PA Content Credentials standard, and Google Docs version history do this at different layers. It proves process, not quality, and only survives inside the tool that recorded it — but it is far more honest than probabilistic AI detection.
Get started → · ← All guides · Compare Kompozy vs other tools