How Sora bakes safety into the product surface, not just the model

Provenance is a rendered artifact, not a backend flag

OpenAI says every Sora video carries both visible and invisible provenance signals. The invisible layer is C2PA metadata plus internal reverse-image and audio search tools that trace a clip back to Sora. The visible layer is the part users actually see.

That visible layer is described as a dynamically moving watermark that includes the name of the creator. A moving watermark is a rendering decision made in the video pipeline and displayed on the surface where the content is consumed. It changes what the output physically looks like, not just what metadata is attached underneath it.

The distinction matters because metadata is easy to strip and invisible signals require special tooling to read. A watermark bearing the creator's name is the one signal a person scrolling a feed can register without any tooling at all — which is why OpenAI commits that image-to-video clips featuring real people 'will always have watermarks upon sharing.'

Consent moves into the upload flow

The most product-specific detail is how OpenAI handles uploading photos of real people. Before a user can generate video from an image containing a person, they must attest that they have consent from the people featured and the rights to the media.

An attestation is a front-end gate — a checkpoint the user passes through in the interface before generation proceeds. OpenAI layers stricter guardrails on top for these generations, and stricter still for images that include children or young-looking people.

The characters feature (formerly called cameo) extends this into a permissions model. OpenAI states that only the person decides who can use their character, access can be revoked at any time, and every video using a character — including drafts made by other users — is visible to that person for review, deletion, or reporting.

Feed and messaging are shaped for the user, not just filtered

The teen protections are entirely about how the app behaves. Teen profiles are not recommended to adults, adults cannot initiate messages with teens, and by default teens face limits on how much they can continuously scroll.

A default scroll limit is an unusual thing to see listed as a safety feature. It is a design constraint on the consumption surface itself, not a content filter. Parental controls in ChatGPT can also toggle whether teens send and receive DMs and switch the Sora feed to a non-personalized version.

On the recourse side, OpenAI says every video, profile, direct message, comment, and character can be reported, and blocking an account prevents that account from seeing your profile or posts, using your character, or messaging you. These are all interface affordances the user operates directly.

The audio and music line is drawn at the prompt

OpenAI notes that adding audio raises the bar for safety. Sora scans transcripts of generated speech for policy violations and blocks attempts to generate music that imitates living artists or existing works.

The post is candid that this is hard: 'Adding audio to Sora raises the bar for safety, and while perfect protections are difficult, we continue to invest seriously in this area.'

Our systems are designed to detect and stop such prompts, and we honor takedown requests from creators who believe a Sora output infringes on their work.Montana Labs

What this means for teams building generative front ends

The Sora write-up describes safety as a set of surfaces a user touches: an attestation before upload, a moving watermark on the output, a permissions panel on a character, a scroll limit on a feed, a report-and-block button on every object. Much of the enforcement lives where the user is, not only in the model.

There is also a caveat embedded in the document itself. It carries a March 23, 2026 date, notes a 'previous version,' and states that as of April 26, 2026 the Sora product is no longer available. Teams reading this as a template should treat it as a snapshot of a fast-moving product, not a settled standard — the safety surface described here was already being revised as it shipped.