Let my agent talk to your agent

What Anthropic actually shipped

The mechanics are worth getting right, because the design tells you what the mark can and cannot do.

SynthID-Text works by changing the source of randomness when the model picks among words that are all equally valid in context. Instead of an arbitrary choice, a cryptographic key and the preceding words steer the selection, so the finished text carries a statistical signature that only the key can read. All future Claude models generate watermarked text at launch. Models released before August 2 fall under an EU transition period and get the mark over the coming months. Images and files get a different treatment, C2PA content credentials in the metadata.

Anthropic is refreshingly plain about the limits, and the limits are the interesting part. In their words, "light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." Detection "doesn't work well on small samples," and the mark is "sparser on factual passages where there are fewer choices," because when the right word is the only word, there is no room to hide a signal. Detection is probabilistic: you get "a probability that the text was generated by Claude," not a yes or no.

And then the line that matters most for anyone thinking about provenance. The watermark, by Anthropic's own account, cannot "distinguish 'Claude wrote this' from 'Claude heavily edited this.'"

Why we do not love it

Read that last limitation again, because it is not a bug in the implementation. It is the whole nature of the thing. The watermark detects that Claude's word-selection touched the text. It was never built to detect who did the thinking, and it cannot be, because that is not a property of the words. A polished paragraph where a person set every constraint and a paragraph the model produced on autopilot can carry the identical mark. The dye is in the ink, not in the intent.

Now put that next to where the work is going. Your agent drafts the proposal. My agent reads it, summarizes it, and drafts the reply. A person on each end decides what to actually do. Let my agent talk to your agent, and within a year the machine will have touched the words in nearly every email, deck, memo, and contract that crosses a desk. When authorship-by-machine is the default state of all professional text, marking each token as machine-touched is marking every drop in the ocean. The signal costs almost nothing to produce and tells you almost nothing you did not already assume.

We are not saying this because we want to hide that we use AI. We build with it in the open, every day. Nobody should be surprised anymore that a document was drafted with a model, and a company that panics about a watermark on its output is usually a company that was quietly selling the typing as if it were the craft. The typing was never the craft. That surprise expired.

The provenance that actually matters

If marking the machine is the wrong layer, what is the right one?

The provenance worth keeping is human. What did the operator point the agent at, and what did they deliberately leave out. What did the model propose that got thrown away. Where did someone catch it being confidently wrong, a citation to a function that does not exist, a number that looks right and is not, and stop it before it shipped. Was the voice scrubbed until it read like a person actually meant it, or was the first draft pushed straight to a customer. That trail is the real record of who is accountable for a piece of work, and no per-token watermark can reconstruct any of it.

This is the same thing we mean when we say the model is a commodity and the judgment is the product. The frontier labs will keep trading the lead on raw capability, and that capability is increasingly something you rent by the token. What does not commoditize is the layer on top: grounding the model in your own information so it is not guessing, fencing it with guardrails so it fails closed, and keeping receipts on what the agent did and why. A watermark can certify the commodity. It cannot certify the judgment, and the judgment is the only part a buyer is actually paying for.

How we build provenance

When we deploy AI inside a client operation, the provenance we care about does not live in the output, it lives in the process. The agent works against the client's own data, not the open internet, so its answers trace to something real. The decisions it is allowed to make are bounded, and the risky ones route to a person on purpose. And the trail of what it did, what it was asked, what it produced, what a human approved, is kept as a record you could hand to a regulator or a customer and defend.

That kind of provenance has a property the watermark does not: it survives a rewrite, a translation, and a round-trip through some other model, because it was never a fragile pattern in the text. It is an account of the judgment, and judgment does not wash out in the edit.

What this article is not

This is not a claim that Anthropic did something careless. They are meeting a real legal deadline, the SynthID approach is honest engineering, and they document its limits more candidly than most vendors would. Machine-readable marking has legitimate uses, and we are glad it exists for them.

It is also not a claim that watermarking is useless or that you should route around it. And it is not a technical takedown of SynthID, nor a scoped proposal for your business. It is one point, stated once: the mark certifies the least interesting fact about a piece of work, and the interesting fact is still yours to prove.

One-sentence takeaway

When my agent talks to your agent, "a machine touched this" becomes the least useful thing you can know about a document, and the provenance worth keeping is the human judgment behind it, which is exactly the record we help clients build.