Responsible AI
Trust
Content provenance
I designed the Content Credentials experience for Microsoft's video player and provenance checking site, quiet when media checks out and interrupting only when it's broken. In an 8-person study it helped people trust real media more and doctored media less.
My part
Designer: player experience; co-ran research
Duration
2022 – 2024
Crew
PM, UX research, engineering, nonprofit partners
Ships on
Media player · web
Context & role
Microsoft co-founded the Coalition for Content Provenance and Authenticity (C2PA) in 2021. By 2023, C2PA signing was available in Azure Media Services, and Content Credentials had been added to Bing Image Creator and Microsoft Designer. Ahead of the 2024 US elections, the team planned a signing website for campaigns and journalists, a verification website and a mobile app for signing at capture: three users with three jobs. My role: I was the product designer on the Azure Media Services player experience for Content Credentials, co-ran the study of the provenance checking site, wrote the interview script for the signing research, and set up the design review of the signing app's icon metaphor. The PM owned product direction and wrote the player spec I designed from.
Stakes
A credential is a cryptographic statement about history, but people read it as a verdict. In a study of AI-generated images, 6 of 7 participants read the "AI" mark as "AI created", 7 of 8 assumed it also vouched for the article's text, and 3 of 8 trusted the article more simply because a mark was there. Ahead of the 2024 US elections, a signal that gives deceptive content a halo would spend Microsoft's reputation instead of protecting people.
Reframe
Asked: display the manifest. Reframed: calibrate trust.
The problem as given was implementation: get C2PA manifests into products and show that a file carries Content Credentials. I used the research goal, "appropriately calibrate trust", as the test for every screen: does this help someone trust trustworthy media a little more and deceptive media a little less, without understanding certificates? That test also said what not to build: no trust-list language for viewers, no badge that reads as a verdict, no validity windows or error codes.
Illustration: an always-on badge, versus a credential that stays quiet when valid and interrupts when broken.
Evidence
Three studies changed what we showed
With two researchers I ran rapid iterative testing of a provenance checking site with 8 media consumers and creators, across images, video and PDF. Ordinary evidence did the work: timestamps and thumbnails helped people spot doctored media, while technical messages made them less sure. A "trust list" message read as Microsoft endorsing organizations, and location data felt invasive. I also wrote the script for signing research with campaign and creative professionals, starting from their real publishing workflow.
01
A mark reads as a verdict. People assumed a credential vouched for everything around it, including the article's text.
02
Ordinary evidence beats technical detail. Timestamps and thumbnails helped people spot doctored media; technical messages made them less sure.
03
"No credentials" means two things. An older file and a creator who chose not to disclose look identical unless the design says which.
In their words
"Pretty sketchy."
Study participant, on noticing that a clip's audio and video carried different dates
Key decision
Say less when it's fine. Interrupt only when it's broken.
The early player kept a credential on screen at all times, with several validation states and an icon on every edit. The alternative was two states: a valid credential stays quiet and appears on hover, and an invalid one pauses playback, stays visible during the affected segment and marks it on the timeline. We chose the quiet valid state because a constant mark was being read as a verdict, accepting that viewers get less passive reassurance and experts must click "View more" for technical detail. A platform constraint shaped it too: the player fixes icon sizes, so the invalid state had to stand out through colour, persistence and the timeline mark instead of size.
Second call
Test the signing tool against the people who would misuse it
The call that was clearly mine came in the signing research. Alongside a storyboard of the tool used as intended, I put a misuse storyboard in front of campaign staff, the people most likely to be targeted, and asked who would lie, at which step, and what the site should do to prevent it. I chose that over a happy-path concept test because a signing tool that assumes good faith turns a signature into a credibility stamp for anyone, accepting a harder and more political conversation in each session. The research put misuse into the requirements for the elections signing tools.
Illustration: the two calls that shaped what people end up believing.
Craft
Every state of the player, including the broken one
The player panel shows the organizations that touched a video first, most recent at the top, with each one's assertions behind a drop-down. "View more" opens the full detail in a new tab so the video keeps playing. Edits use only the verbs the pipeline performs (converted, cropped, edited, filtered, resized, transcoded) with no decorative icons, so the history never claims more than the system can prove. The invalid state is designed to be impossible to miss: a pause-and-dismiss alert, a persistent red icon during the affected segment, and a mark on the timeline.
Illustration: every state of the player and the checking site, including no credentials at all.
System
Six rules for any surface that shows provenance
Each rule traces to a study finding, so a team adding Content Credentials could adopt it without repeating the research. Stay quiet when the history checks out, and interrupt only for malicious changes or removal. Use plain words, and keep trust lists and validity windows away from viewers. Show ordinary evidence first: who touched the media, when, and a thumbnail of each version. Say what's unknown. Disclose AI origin plainly and expect any mark to be over-read. Claim only what the pipeline did. The checking site's error messages were later rewritten in this plain-language style.
Illustration: six rules, each traced to a study finding, for any surface that shows provenance.
What shipped
What the team took forward
The player spec moved from a technical "Provenance" overlay to a two-state Content Credentials experience: quiet on hover when valid, with progressive disclosure through View more, and a pause-and-dismiss alert, persistent red icon and timeline mark when part of a video can't be verified. The checking site's messages were rewritten in plain language, with no raw error codes or trust claims shown to viewers. The signing research put misuse into the requirements for the elections signing tools, which the team took toward a private preview for elections customers. The six provenance rules gave any team adding Content Credentials a starting point that traced back to research.
Outcome
What changed
In the 8-person study, provenance checking helped participants trust trustworthy media more, whether captured, composited or AI-generated, and trust deceptive media less. The player moved from a technical "Provenance" overlay to a two-state Content Credentials experience with progressive disclosure, and the signing research put misuse into the requirements for the elections signing tools. No shipped usage figures are available.
Reflection
Test what people conclude before designing what they see
I would push for comprehension research before the player design, not after. The study confirmed most of our simplifications but surfaced cases we hadn't designed for, like telling an older file apart from a creator who chose not to disclose. I would also treat the signer and the viewer as one system from the start. The principle I took away: trust signals are a system, not a component, and a weak link anywhere turns a safety feature into a liability.
