-
1
-
2
-
3
-
4
-
5
-
6
-
7
-
8
-
9
-
10
-
11
-
12
-
13
Inspiration
I've sat on both sides of this problem. During engineering interviews, I've been asked to show original work - things like an actuator designed from my own calculations and derivations, an unconventional wind tunnel setup, or a boat hull profile - with nothing stopping the company from taking the idea and giving me no credit, no offer, and no way to prove what actually happened. I've watched friends go through the same thing with take-home assignments that ran for days and led nowhere. And I've seen freelancers, often students picking up side income, deliver finished work and then get ghosted on payment, with no real recourse; a legal case costs more than what they're owed, and a public complaint rarely changes anything.
Once I started looking, I realized this isn't just my own frustration. On Blind, candidates describe the exact same pattern at major companies: multi-day take-home work treated as free labor, with no compensation and no hire at the end. The design industry has had a formal position against uncompensated "spec work" for decades, through AIGA. The problem is old, documented, and widespread, but nobody had built an actual enforcement mechanism for it. That's what pushed me toward building Provenance on top of AI Passport.
What it does
Provenance lets a freelancer, candidate, founder, or researcher share original work - a CAD model, a dataset, a research draft, a portfolio piece - under passkey-protected, time-boxed, watermarked view-only access, generated straight from their AI Passport page.
The owner controls exactly what's visible, component by component: title, abstract, images, the 3D model itself, data, graphs, references, each toggled independently, not locked into a fixed tier. The raw file stays withheld by default. Every view is logged as a cryptographically signed Audit Receipt: who accessed it, when, for how long, and which components they saw, and access can expire automatically, be revoked manually, or be shut off instantly if tampering (screenshot or screen-recording attempts) is detected.
Over time, the owner builds up a portable record of who they've shown work to and under what terms, something they can point to with the next client or interviewer, instead of starting from zero trust every time.
How I built it
This is a Concept-lane entry, so the goal was to demonstrate the working principle clearly rather than ship a functioning backend. I wrote the full product write-up as a structured document covering the problem, the passport claim (what's proved, carried, and revoked), an access-control matrix across five real scenarios, privacy and risk mitigation, and a V1/V2 scope split. Alongside that, I built an interactive HTML/CSS/JS prototype showing the actual flow: a vault of sample projects, the share modal with the component-level toggles, the passkey generation, and a live audit dashboard with session logs and signed receipts.
Challenges I ran into
The biggest one was resisting the urge to make the disclosure model too simple. My first pass had a tiered selector - Title Only, Abstract, Full View - which felt clean but didn't actually reflect how people want to share work. A candidate might want the 3D model visible but the underlying data hidden; a researcher might want graphs shown but references withheld until publication. Moving to independent, per-component toggles was a small technical change but a much better fit for the actual claim: the owner controls exactly what's shown, not a menu someone else designed.
I also had to be honest about what this can and can't guarantee. Watermarking can't stop someone from pointing a phone camera at a screen, so instead of overselling prevention, I leaned into what the system can actually promise: traceability and an evidentiary record, not an unbreakable seal.
Accomplishments that I'm proud of
Grounding the problem in real evidence rather than just personal frustration, citing the Blind "idea farming" pattern and AIGA's decades-old spec-work position gave the pitch weight it wouldn't have had otherwise. I'm also glad I caught and fixed my own tiered-disclosure design before it became load-bearing in the pitch; getting that right early made everything downstream (the matrix, the claim language, the mockup) more coherent.
What I learned
How much of "trust" in professional and creative work comes down to nothing more than a file being sent and hoped for. There's no shortage of tools for storage, sharing, or even expiring links, but almost nothing that turns a disclosure into a provable, revocable, auditable event. Building this made clear how large that gap actually is, once you start looking for it across freelancing, hiring, and research.
What's next for Provenance
Session-based dynamic watermarking and an integrated escrow/payment gate are the next concrete steps, so full access can be conditioned on payment clearing rather than just a manual toggle. The same underlying primitive - prove, carry, revoke - could also extend to how organizations share data with each other, though this entry stays deliberately scoped to the individual case, where the problem is least served today.
