05 October 2026

Attendees

  • Adam Fiock, SSL.com

  • Andy Rosen, SequenceKey

  • Bill Huang, Trufo

  • Brad Stewart, Verified Human

  • Dom Guinard, SSL.com

  • Drummond Reed, First Person Project

  • Eric Scouten, Adobe

  • Grace Rachmany, DIF

  • Iman Attia, EBU

  • Jenny Pretz, RIAA

  • Jeremy Uzan, Universal Music Group

  • Juan Caballero, DIF

  • Makki Elfatih, HKDolts

  • Matthew Rappard, Cognitive Proof

  • Michael Stattmann, Castlabs

  • Nathan Freitas, Guardian Project

  • Padma, Castlabs

  • Peleus Uhley, Adobe

  • Richard W. Kroon, EIDR

  • Scott Perry, Digital Governance Institute

  • Toby Weir-Jones, Verisign

  • Victor Grey, JLINC

  • Will Kreth, HAND (Human & Digital) Identity

Meeting notes

Start meeting

🎥 10'05": Eric gave the standard reminder that the meeting operates under the DIF Code of Conduct and the W3C IPR policy. Grace clarified that only those who have signed the DIF IPR agreements can participate actively; others are welcome to listen in.

New members introduction

🎥 5'44": Brad Stewart, Verified Human – certifies human authorship in music and audio. Interested in the operating side of running an attester. He is contributing a use case to the Trust Task Force on 12 October and offered to help with conformance scope.

🎥 6'34": Adam Fiock, SSL.com – a certificate authority; interested in compliance.

🎥 7'10": Iman Attia, EBU – interested in CAWG from a privacy perspective.

🎥 7'58": Michael Stattmann, Castlabs (with colleague Padma, product manager) – media technology company with a C2PA-approved certificate authority, a generator product in the conformance program, and video players. Castlabs wants to issue CAWG certificates and use them in its generator product; its main markets are news publishers, broadcasters, and content creators.

Review previous action items

🎥 10'57": Skipped this week.

Readout from Friends of CAWG meeting

🎥 11'06": Eric reported on last Friday’s working meeting at Adobe, attended by about 30 people including several who have not been able to take part in CAWG until now. It gave Eric and Scott direction on CAWG’s scope and organizational structure. Scott added that executives from the usual participating organizations attended, giving a fuller picture of their positions.

Scope

🎥 13'07": CAWG should be the home for creators and creator identity in the Content Credentials ecosystem: who is claiming credit or a role in producing a C2PA asset, and what stable facts about that act of creation can be stated in the manifest. Rights, licensing, and consent change over time and vary by region and contract, so CAWG will provide a standard way to link to authoritative external sources (such as those run by DDEX) instead of expressing that data in the manifest. This deprioritizes a few topics discussed previously.

🎥 15'26": Matthew and Jenny explained the music industry’s view: the data is dynamic (a media asset can have up to seven rights holders, updated as often as weekly), and creators may assert rights they don’t actually hold. In chat, Brad suggested adding certification and verification status to the mutable-data category, with the external link carrying a freshness expectation as well as a location.

🎥 17'59": CAWG will define the structure and extension points; each industry self-organizes and writes its own profile (vocabularies, how membership is recognized, what external data to expect).

🎥 19'04": Asked about agentic systems, Eric said a software tool is a claim generator named under C2PA, and the person or organization operating it is a named actor in CAWG; he has not yet seen that model break down. Scott said agentic is on the table as an extension of identity relationships, though less mature than the three identity types the Trust Task Force started with (organization, individual, and sponsor-validated). Michael offered an AI dubbing and translation use case. Scott said who is making a claim is in scope, while whether they have the right to make it is for industry to decide.

🎥 23'31": Andy said motion pictures already depend on the SMPTE registry and urged speed, since studio pipelines assume identity and consent infrastructure exists. Scott said CAWG will ask SMPTE and the studios what they need and provide the standard structure for it. Jenny offered to walk the group through recent ISNI and DDEX work on parties and AI use cases.

ACTION: Jenny to present the ISNI/DDEX party and AI use-case scenarios at a future meeting and relate them to CAWG’s work.

New home

🎥 27'45": The proposal is for CAWG to become an independent, initially unfunded Joint Development Foundation project under the Linux Foundation, separate from C2PA (similar to how C2PA is organized). Eric said that, barring major objections, he and Scott will start talks with Grace, Juan, and the DIF steering committee about leaving DIF, with thanks for DIF’s hosting over the past year and a half. No objections were voiced.

🎥 29'36": Grace said it is legitimate for industries to make this decision, but unusual for the discussion to take place outside DIF’s IPR agreement and open only to a select few. She invited anyone uncomfortable objecting in this group to contact her or Juan privately. Eric also welcomed feedback on the decision and how it was made.

Trust governance

🎥 30'57": Eric described two layers: CAWG sets the top-level framework for identity verification and credential issuance, while industry bodies (for example, IPTC for news publishers) decide who is credentialed in their industry. CAWG will define how such bodies are recognized and what data they must provide. Scott said this works because CAWG left industry-specific governance to industry, and industry accepted that. Drummond said this is the two-layer model of a governance framework of governance frameworks, as in the Trust Over IP metamodel. Matthew stressed the need for education so industries understand the structure; Scott said the CAI could help. Eric compared the approach to the JDF’s own pre-built recipe for forming an organization: CAWG should give industries a form to fill in.

Steering committee

🎥 39'56": The committee should stay small. The charter will set participation expectations, term limits, rotation, and removal for non-participation, with diversity across industries, organization sizes, geographies, and organization types, and a mix of creators and technology companies. A couple of industries were flagged for extra attention. Scott said seat holders must represent a broader swath of viewpoints and do the work, not only speak for their own company. Drummond said in chat that stakeholder-group representation should be the top goal. Matthew suggested a seat focused on decentralized identity; Eric agreed and said CAWG should seek liaison relationships with DIF and Trust Over IP.

Naming

🎥 46'44": There is a strong current of opinion that "CAWG" is a poor name. A small group will bring back cleared options before any documents are signed; anyone with naming experience should contact Scott or Eric. Scott said "working group" no longer fits, "creator" and "attribution" matter, the name should extend beyond creative industries, and it should reflect a B2B mission. In chat, Bill suggested keeping the CAWG acronym (for example, "Credential Attestation & Web Governance"), and Jenny suggested "Authenticity Network for Digital Identity."

🎥 49'17": Eric did not read through the timeline; the agenda lists charters going to Linux Foundation staff on 16 October, a unified CAWG 2.0 draft circulating on 30 October, the new technical working group reviewing CAWG 2.0 in mid-to-late November, a public announcement in late November, and CAWG operating as an independent project by mid-December. He asked for help with naming and for feedback on the charter and scope, sent to him, Grace, or Juan.

🎥 50'03": On the relationship to C2PA, Scott said CAWG is dependent on C2PA but wants to be separate and aligned; the C2PA chair and vice chair supported alignment without complete merging. Eric said C2PA leadership has been supportive.

🎥 51'24": Matthew suggested a wiki for name submissions and asked that any rename consider CAWG-specific error codes and labels. Eric said he will resist renaming assertion labels or error codes, since renaming the training and data mining assertion earlier made it hard to know what to read and write. Andy argued for a professional brainstorm over a wiki.

In chat, Brad asked whether the call for patent exclusions will state the controlling deadline and the specifications covered, and where it will be published. This was not answered in the meeting.

ACTION: Eric and Scott to begin conversations with the DIF steering committee about CAWG becoming an independent organization.

ACTION: Anyone with naming experience to contact Scott or Eric; anyone with charter or scope feedback to contact Eric, Grace, or Juan.

Readout from definitions task force: Erik

🎥 54'18": Erik could not attend; Eric reported that the task force advanced definitions of particular terms and expects to bring a draft to the full group for a vote in about a month. This week’s meeting is moved to Thursday, 15 October.

Readout from trust task force: Scott

🎥 54'56": The task force had been working on a governance-backed assertion using trust registries and the Trust Registry Query Protocol, but interest has grown in a CAWG certificate policy for X.509 certificates. Scott drafted one from the C2PA certificate policy and the CA/Browser Forum S/MIME Baseline Requirements, whose organization, individual, and sponsor-validated tracks suit CAWG. The group has homework to review it, with discussion at the next meeting on 12 October. Scott also circulated earlier Trust Over IP work on issuer requirements for verifiable credentials, aiming for comparable identity-verification assurance across X.509 and verifiable credentials.

In chat, Brad asked about the format and length of contributions for 12 October; this was not answered in the meeting.

Readout from UX task force: Matthew

🎥 59'54": C2PA is discussing summarization (aggregating many manifests). Matthew believes there are industry-specific concerns for CAWG and will return to the topic.

Readout from vLEI task force: Vasily

🎥 1h00'47": Vasily was not present; no readout.

Review active PRs

🎥 1h01'04": Matthew asked people to review his two PRs on repeated trust-registry (TRQP) queries. Bill’s PR was deferred; PR #278 was not discussed.

🎥 1h02'12": Eric proposed extending the S/MIME sunset date from 31 March to 31 August 2027 in the CAWG 2.0 draft, since a replacement won’t be ready by March. Dom asked whether a sunset is needed at all, noting that people are invested in S/MIME, which works today. Eric said yes: he wants pressure on CAWG to create its own certificate policy and doesn’t want to commit to S/MIME in perpetuity, though that could be decided later. Matthew suggested accepting it indefinitely but within a defined scope. Bill said CAWG needs its own governed primary method and shouldn’t promise more than the standard can deliver. Scott said the draft policy will follow generally accepted standards, using constructs like EKUs and OIDs, without new concepts that burden CAs.

No decision was taken; the question is referred to the Trust Task Force.

ACTION: Trust Task Force to take up the S/MIME sunset question, including Dom’s previously submitted issue.

Review/triage new issues

Not covered this week.

AOB

🎥 1h07'00": None. The next meeting is in two weeks.