AI Creation Passport

AI Creation Passport turns trusted AI-assisted work into economic opportunity by verifying provenance, measuring human contribution, certifying outputs, and connecting creators to jobs and markets.

Comment

Inspiration

AI now lets one person or a small team create products, research, media and businesses at unprecedented speed. But once an AI-assisted creation exists, the important questions go unanswered: Who contributed what? Which AI systems, resources and decisions were involved? What evidence backs the declared process? Can an organization, client or marketplace trust the result?

AI Creation Passport exists to answer those questions. It's part of AI Creation Network, a broader infrastructure connecting AI-assisted creation, provenance, collaboration, resources, trust and economic opportunity.

The idea in one line: Create. Verify. Prosper.

What it does

AI Creation Passport turns an AI-assisted output into a structured, traceable production record. A creator or organization can:

  • develop an idea and turn it into a project;
  • collaborate with a team under role-based permissions;
  • document a workflow of ordered production steps and human decisions;
  • declare AI interactions and the role AI played;
  • connect providers, capabilities, compute resources and allocations;
  • upload private evidence assets under quarantine scanning and controlled, token-gated access;
  • register a creation output;
  • draft a Passport narrative;
  • submit a structured AI production declaration and see the five server-computed score dimensions;
  • keep declared evidence, the score, the Passport, and independent certification visibly separate — the interface says it directly: "the Creation Passport tells the story, the declared AI Production Score measures the declaration, evidence lives in project assets, and independent certification is a separate future process. None of them replaces the others."
  • prepare a listing for a future marketplace — browsing and drafting work today; buying, orders, payments and publishing a listing live are deliberately out of scope until those flows are certified.

The platform never treats a Passport as an automatic certification. That boundary is stated on the product's own public Passport page, not just in our internal docs.

How we built it

Backend: Django + Django REST Framework, PostgreSQL, Redis, Celery (worker + beat), MinIO for private asset storage. Tenant-aware RBAC/ABAC, server-side sessions with email verification and optional TOTP MFA, idempotent state transitions with concurrency protection, quarantine-aware private assets, structured workflows with declared AI-interaction records, OpenAPI generation with drift protection, and a consent/export/erasure privacy workflow.

Frontend: Next.js, React and TypeScript, talking to the backend through a same-origin session/CSRF proxy, with a frozen, drift-gated set of 26 supported API route families, automated WCAG A/AA coverage, a Content-Security-Policy, and a certified Desktop-Chromium + Pixel-7-class-mobile Playwright matrix.

The provenance boundary: this platform predates OpenAI Build Week — the backend was already a working Django/DRF application through commit 582c08e on 2026-07-07. We did not present pre-existing work as hackathon output. Instead, every commit from the eligibility threshold onward is documented in docs/hackathon/BUILD_PROVENANCE.md with its exact hash, timestamp, and — where a commit trailer actually records it — its assisting AI tool.

From the wave-31 documentation commit through wave 51, commits carry a contemporaneous AI-Assisted-By: OpenAI Codex trailer. This is where Codex accelerated the work the most: it took the backend from a working MVP to a hardened, contract-frozen v1 (tenant authorization, identity/session security, idempotent financial and workflow mutations, webhook security, observability, data-governance workflows, CI release gating), then bootstrapped the entire Next.js frontend from nothing — public site, authentication, personal hub, organization collaboration, and the idea/project creation flow — in six consecutive waves. The four commits immediately after the eligibility threshold (the earliest backend-hardening work) carry no AI-assistance trailer at all, and we do not claim Codex authorship for them.

The remaining frontend surfaces — project workspace, workflows, providers/resources, outputs/passports, marketplace, privacy/consent, release certification, outbound email delivery, the public contact/social footer, and the MFA QR code — were built by Claude Code (Anthropic) after Codex's session usage limit was reached and had not yet reset. We recorded that explicitly rather than blur the two contributions together.

Product direction, scope decisions, and every release authorization stayed with the human founder throughout.

Challenges we ran into

The hard part was never generating a Passport document — it was designing a trustworthy lifecycle around one. We had to make sure:

  • a user can never reach another organization's projects or evidence;
  • human decisions stay visible instead of disappearing behind AI output;
  • the Passport, the declared score, the evidence, and certification are never visually or semantically confused;
  • state transitions are idempotent and safe under concurrent requests;
  • private assets are scanned and only ever downloaded through a protected, token-gated flow;
  • experimental or staff-only backend routes (marketplace publish, review actions, passport issuance) never leak into the public interface, even though the backend serializers technically accept them;
  • the contribution of every AI development assistant is represented honestly — including the waves where no AI assistance is evidenced at all.

We also had to build a complete, accessible, responsive interface over a large, already-frozen backend contract, without breaking that contract, while adding security headers and predictable failure states along the way.

Accomplishments that we're proud of

Reproduced and verified in this repository, not just claimed:

  • 657 passing backend tests (identical on the host and inside Docker);
  • 57 passing frontend unit tests across 26 files;
  • 74 passing Playwright end-to-end journeys (2 intentionally skipped, mobile/project-scoped), across Desktop Chromium and Pixel-7-class mobile emulation;
  • a frozen, drift-gated set of 26 supported frontend API route families;
  • automated WCAG A/AA accessibility coverage;
  • production security gates and a verified Content-Security-Policy;
  • a fully documented, evidence-based provenance record distinguishing pre-existing work, Codex-assisted work, Claude-Code-assisted work, and the commits where no AI assistance is evidenced at all.

Most importantly: the platform shows that provenance can live inside the creative workflow itself — not get bolted on afterward as an unverifiable badge.

What we learned

Trust isn't a badge you stick on an output after the fact. It needs a connected system: identities, permissions, declared interactions, evidence, lifecycle rules, human decisions, audit records, and clearly defined verification boundaries that nothing in the interface is allowed to blur.

We also learned that AI-assisted software development needs its own provenance discipline. So this repository documents, commit by commit, what predated the hackathon, what Codex actually touched, what another AI assistant touched, and — just as importantly — where the evidence runs out and we say so instead of rounding up.

What's next for AI Creation Passport

  • deploy a stable, judge-and-public-facing production environment;
  • connect additional AI and compute-resource providers;
  • introduce externally governed verification and certification workflows — kept separate from the Passport by design, not yet built;
  • strengthen server-side redaction of declared AI-interaction metadata (currently returned unredacted by the API; the frontend already hides it, but the backend fix is still open);
  • certify Firefox and WebKit, beyond today's Chromium/Pixel-7 matrix;
  • complete marketplace transaction and payment certification before enabling real orders;
  • generate portable Passport documents and verification badges;
  • help creators connect verified AI-assisted work to real clients, jobs, funding and markets.

AI Creation Passport turns human–AI creation into a record worth trusting — and, eventually, a verifiable economic opportunity.

Built With

Share this project:

Updates