Build Claude Watermark-Verified Content Provenance Workflow

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Introduction

In August 2026, Anthropic published the technical detail behind Claude's cryptographic watermarking: a signing scheme layered into token sampling that embeds a provenance mark in generated text, verifiable offline by anyone holding the public verifier key. The scheme is probabilistic — a sequence of token choices that a forger would have to reproduce to defeat it — and it is designed to survive the common laundering attacks: rephrasing, translation, and interpolation. This dispatch builds the LangGraph workflow, provenance-guard, that operationalizes it: generate with a watermarked Claude model, detect the watermark and verify Content Credentials (C2PA) claims, route verified versus unverified content to different pipelines, and log every decision to a provenance ledger.

For publishers, marketers, and platforms racing to label AI content, this is the missing technical half of the story. The labeling mandate arrived long ago; the verifiable label is new. The compliance-grade mindset we have applied to agent workflows applies here: generate, verify, route, log — with humans in the loop where the verification is ambiguous.

How Claude's watermarking works — and where it stops

The watermark is added at sampling time, not post-hoc. The decoder entropy is steered toward a secret set of token bands, so the resulting text carries a statistical signature that a verifier can detect with a score. Because it is embedded in the sampling distribution itself, it is cheaper to leave in than to strip out, which is the property that makes it practical.

Robustness limits and bypass tradeoffs — worth internalizing honestly:

• No watermark survives everything. Very short generations (a tweet, a headline) carry too little signal for reliable detection. The verifier reports confidence, not certainty.
• Heavy obfuscation degrades detection. Aggressive paraphrase-and-regenerate, translation loops, or boiling text through a non-watermarked model erodes the statistical signature. Removing it fully costs quality and time — the economics favor leaving it in.
• No cryptographic forging. The sampling key is secret and the verifier key is public; a forger cannot craft text that falsely carries a real Claude watermark. That property is what makes the whole scheme useful.

So the honest design goal is not detect everything but make laundering more expensive than the content is worth — the same cost-inversion logic used in DRM and abuse control.

Architecture overview

graph TD
  A[Prompt + Policy] --> B[Watermarked Claude]
  B --> C[Content]
  C --> D{Watermark Detect}
  D -->|score >= t| E[Verified Lane]
  D -->|score < t| F[Unverified Lane]
  D -->|ambiguous| H[Human Review]
  E --> G[C2PA Encode + Sign]
  G --> I[(Provenance Ledger)]
  F --> J[(Suspicion Log + Regenerate)]
  H --> E
  H --> F

Part 1 — Configuration and schemas

.env

ANTHROPIC_MODEL=claude-opus-5-watermarked
ANTHROPIC_API_KEY=sk-ant-xxxxxxxx
VERIFIER_ENDPOINT=https://watermark.anthropic.com/v1/verify
VERIFIER_PUBLIC_KEY_ID=wmk-pub-2026
DETECT_THRESHOLD=0.7
C2PA_SIGNING_KEY=ec_seckey_2026
LEDGER_DB_URL=postgresql://prov:secret@pg-ledger.internal/provenance
MAX_REGENERATE=3

schemas.py

from pydantic import BaseModel, Field
from typing import Literal

class GenRequest(BaseModel):
    content_id: str
    prompt: str
    model: str
    policy: str = 'brand-safety-v2'

class VerifyResult(BaseModel):
    content_id: str
    model: str
    watermark_score: float
    threshold: float
    verdict: Literal['verified', 'unverified', 'ambiguous']
    detected_likely_model: str | None = None

class ProvenanceRecord(BaseModel):
    content_id: str
    manifest: dict            # C2PA claim: producer, signature, content hash
    verdict: VerifyResult
    route: Literal['publish', 'review', 'reject', 'regenerate']
    ledger_hash: str
    parent_hash: str
    created_at: str

The VerifyResult keeps the raw score and the threshold separate, because the auditor must be able to recompute the verdict from the numbers. ProvenanceRecord is the ledger row: manifest, verdict, route, and the chained hashes.

Part 2 — Generation and verification tools

tools.py

import httpx
import os

def generate_watermarked(req: GenRequest) -> str:
    r = httpx.post('https://api.anthropic.com/v1/messages',
                   json={'model': req.model,
                         'messages': [{'role': 'user', 'content': req.prompt}],
                         'watermark': {'enabled': True}},
                   headers={'x-api-key': os.environ['ANTHROPIC_API_KEY']},
                   timeout=90)
    r.raise_for_status()
    return r.json()['content'][0]['text']

def verify_watermark(text: str, content_id: str) -> VerifyResult:
    r = httpx.post(os.environ['VERIFIER_ENDPOINT'],
                   json={'text': text, 'key_id': os.environ['VERIFIER_PUBLIC_KEY_ID']},
                   timeout=60)
    r.raise_for_status()
    score = r.json()['watermark_score']
    t = float(os.environ['DETECT_THRESHOLD'])
    if score >= t:
        verdict = 'verified'
    elif score >= t - 0.15:
        verdict = 'ambiguous'
    else:
        verdict = 'unverified'
    return VerifyResult(content_id=content_id, model=os.environ['ANTHROPIC_MODEL'],
                        watermark_score=score, threshold=t, verdict=verdict)

c2pa.py

def sign_manifest(content_id: str, text_hash: str) -> dict:
    # Build a C2PA assertion and sign it with the content credential key
    claim = {
        'assertions': [
            {'label': 'c2pa.ai-generated',
             'data': {'producer': 'claude', 'watermark': 'verified'}},
        ],
        'contentHash': text_hash,
        'signature': c2pa_sign(os.environ['C2PA_SIGNING_KEY'], text_hash),
    }
    return claim

C2PA Content Credentials in depth

Content Credentials is the packaging, not the proof — the proof is the watermark score, and C2PA carries it to a consumer. The manifest bundles assertions into a signed claim: an ai-generated assertion with producer and verification result, the contentHash of the exact bytes, and the producing software. The signature validates against a public certificate chain, so any C2PA-aware consumer can check producer identity without trusting your site. For text, the manifest travels as a sidecar record joined to the asset by content_id. Its threat model proves who signed what when, not that content was never edited — hence the pair with the score and hash.

Full verification: watermark, C2PA, and content hash

The standalone detector answers is this watermarked; the production verifier answers is this the content we signed:

def verify_all(text: str, content_id: str, manifest: dict) -> dict:
    score = verify_watermark(text, content_id)
    sig_ok = c2pa_verify_signature(manifest)
    hash_ok = sha256(text) == manifest['contentHash']
    return {'watermark_score': score.watermark_score,
            'signature_valid': sig_ok,
            'content_hash_match': hash_ok,
            'verdict': 'verified' if (score.verdict == 'verified'
                                      and sig_ok and hash_ok) else 'recheck'}

Each leg answers a different question: the watermark ties the text to the generating model, the signature ties the manifest to your identity, and the hash ties the shipped asset to the manifest. A recheck verdict routes to human review, never to silent publish.

Part 3 — The LangGraph provenance workflow

graph.py

from langgraph.graph import StateGraph, END
from typing import TypedDict

class ProvState(TypedDict):
    request: GenRequest
    content: str
    verify: VerifyResult | None
    record: ProvenanceRecord | None
    attempts: int

def generate(s: ProvState) -> ProvState:
    s['content'] = generate_watermarked(s['request'])
    return s

def detect(s: ProvState) -> ProvState:
    s['verify'] = verify_watermark(s['content'], s['request']['content_id'])
    return s

def route(s: ProvState) -> str:
    if s['verify']['verdict'] == 'verified':
        return 'publish'
    if s['verify']['verdict'] == 'ambiguous':
        return 'review'
    return 'regenerate'

def publish(s: ProvState) -> ProvState:
    manifest = sign_manifest(s['request']['content_id'], sha256(s['content']))
    s['record'] = ProvenanceRecord(
        content_id=s['request']['content_id'], manifest=manifest,
        verdict=s['verify'], route='publish',
        ledger_hash=chain_hash(manifest, prev_hash()), parent_hash=prev_hash(),
        created_at=now_iso())
    return s

def regenerate(s: ProvState) -> ProvState:
    # re-roll with a fresh seed; cap attempts then escalate to review
    s['attempts'] += 1
    return s

def review(s: ProvState) -> ProvState:
    s['record'] = ProvenanceRecord(content_id=s['request']['content_id'],
                                   manifest={}, verdict=s['verify'],
                                   route='review', ledger_hash=chain_hash({}, prev_hash()),
                                   parent_hash=prev_hash(), created_at=now_iso())
    return s

g = StateGraph(ProvState)
g.add_node('generate', generate)
g.add_node('detect', detect)
g.add_node('publish', publish)
g.add_node('review', review)
g.add_node('regenerate', regenerate)
g.set_entry_point('generate')
g.add_edge('generate', 'detect')
g.add_conditional_edges('detect', route,
                        {'publish': 'publish', 'review': 'review', 'regenerate': 'regenerate'})
g.add_edge('publish', END)
g.add_edge('review', END)
app = g.compile()

main.py

if __name__ == '__main__':
    r = app.invoke({
        'request': GenRequest(content_id='post-4412',
                              prompt='Write a 200-word explainer on C2PA.',
                              model='claude-opus-5-watermarked'),
        'content': '', 'verify': None, 'record': None, 'attempts': 0,
    })
    print('Verdict:', r['verify'].verdict, round(r['verify'].watermark_score, 2))
    print('Route:', r['record'].route if r['record'] else 'regenerated')

The regenerate edge feeds back into generate, forming a bounded loop: each attempt re-rolls with a different seed, and content that fails three verification attempts is routed to human review rather than endlessly re-rolled. Unverified content is never silently published — it either gets regenerated, flagged, or approved by a human who accepts the provenance gap.

Retry rules: generation retries twice on transport errors with exponential backoff. Verification is never skipped and never retried to a false pass — a score below threshold is a real outcome, logged with the raw numbers. The regenerate loop is bounded at MAX_REGENERATE=3, then escalates to review. Ledger writes are transactional: a record is only chained after its parent hash is confirmed, so the ledger cannot fork. This is the same retry discipline we standardized in the AI workflows library.

Part 4 — The provenance ledger and production checklist

The ledger is append-only and hash-chained: each ProvenanceRecord links to the previous record's hash, and the manifest carries the C2PA claim with the signed content hash. A downstream consumer can verify three things: (1) the text was produced by a watermarked Claude model, (2) the manifest was signed by your content-credential key, and (3) the content hash matches the published asset. That is a complete provenance claim.

The provenance ledger schema

The chain lives in the schema itself:

CREATE TABLE provenance_ledger (
  content_id    TEXT PRIMARY KEY,
  manifest      JSONB,          -- C2PA claim incl. signed content hash
  verdict       JSONB,          -- raw score + threshold, never just the label
  route         TEXT,           -- publish | review | reject | regenerate
  ledger_hash   TEXT,           -- sha256(content_id || verdict || parent_hash)
  parent_hash   TEXT,           -- previous row's ledger_hash
  created_at    TIMESTAMPTZ DEFAULT now()
);

Every append references the previous row's hash, so any edit or deletion breaks the chain at exactly that point and every later integrity check fails. Because the row stores the raw verdict and the manifest, the full provenance claim is reconstructable from the ledger alone — a consumer needs the asset, the content_id, and nothing else.

1. Verify before you route. Detection runs before any publish decision; the raw score and threshold are stored, never just the verdict.
2. Treat ambiguous as human. Scores in the gray band go to review, not to the default lane.
3. Regenerate, don't launder. If verification fails, re-roll with the watermarked model — never clean up unverified content and ship it anyway.
4. Chain the ledger. Every record references its parent hash; make the ledger tamper-evident from day one.
5. Document the limits. Publish your detection threshold and the robustness limits of the scheme so downstream consumers set correct expectations.
6. Keep the model swappable. The verifier is keyed by key_id; when Anthropic rotates watermarking keys, update the env, not the graph. The same refresh discipline runs through every workflow guide we publish.

Failure and tamper scenarios

The honest failure modes are worth spelling out, because each maps to a check in verify_all. Key rotation: old content must be re-verified against its generation key, or scores drop and the pipeline misroutes — hence the watermark id stored beside the content. Threshold drift: too high floods review, too low lets unverified content publish; the raw-score column lets you audit later. Manifest tampering: a failed signature check means the manifest or key was compromised, not a benign mismatch. Post-signing edits: break the hash match by design — the manifest certifies the exact bytes, so a new version needs a new signature. Ledger rollback: rewriting a parent hash is only undetectable if every later row is rewritten too, so mirror the chain off-site for independent verification.

Frequently Asked Questions

Q: What did Anthropic disclose about Claude watermarking in August 2026?

A: Anthropic shared technical details of Claude's cryptographic watermarking — a sampling-time signing scheme that embeds a detectable provenance mark in generated text, with an offline verifier keyed by a public verification key.

Q: Is Claude's watermark detectable offline?

A: Yes. Any party holding the public verifier key can score a text and compare against the published threshold — no API call to Anthropic required, which is what makes the verification pipeline independent of the generator.

Q: Can the watermark be removed?

A: With enough compute and quality loss, heavy laundering can degrade the signal, but the scheme is designed to make stripping it cost more than the content is worth. The verifier reports a score and confidence rather than a binary, which keeps the honesty in the system.

Q: What is the C2PA / Content Credentials role?

A: The workflow encodes the verified claim into a C2PA assertion and signs it with your content-credential key, so the provenance travels with the asset and can be checked by any C2PA-aware consumer.

Q: What happens to content that fails verification?

A: It is never silently published. The workflow routes it to a bounded regenerate loop (3 attempts) and then to human review, where a human accepts or rejects the provenance gap explicitly.

Closing thoughts

Claude's cryptographic watermarking makes provenance a verifiable property instead of a declaration. The provenance-guard workflow turns that capability into operations: generate with the watermarked model, score the detection, encode the claim into C2PA, route verified versus unverified content, and chain every decision into a tamper-evident ledger. Respect the robustness limits, keep a human in the ambiguous lane, and treat the threshold as a documented, reviewed number. Track more content-integrity engineering in the AI workflows library and on latest AI news.