Vanity Fair has a fascinating feature today about the CAA Vault — a nondescript building in Burbank where Hollywood's biggest stars go to get digitally cloned. Joy Press got an inside look at the facility where Creative Artists Agency scans actors' faces, bodies, and voices, then stores those digital replicas in secure, individually controlled vaults.

I went in expecting something dystopian. Instead, I came away thinking this is one of the more thoughtful tech-infrastructure projects to come out of the entertainment industry.

The basic idea is straightforward: actors come in, get scanned with an array of cameras and sensors, and walk out with a high-fidelity digital double stored under their control. They — not a studio, not a third party — decide if, when, and how that replica gets used. It's DRM for your own face, and in an era where anyone with a Midjourney subscription can generate a passable celebrity deepfake, that kind of preemptive rights management starts looking less like paranoia and more like common sense.

<svg viewBox="0 0 400 160" xmlns="http://www.w3.org/2000/svg" style="max-width:100%;height:auto;"> <rect width="400" height="160" rx="8" fill="#1a1a2e"/> <text x="200" y="24" text-anchor="middle" fill="#e0e0e0" font-family="monospace" font-size="11">The CAA Vault Flow</text>

<!-- Actor --> <circle cx="50" cy="95" r="20" fill="#16213e" stroke="#e94560" stroke-width="2"/> <text x="50" y="99" text-anchor="middle" fill="#e94560" font-family="monospace" font-size="10">ACTOR</text>

<!-- Arrow 1 --> <line x1="72" y1="95" x2="118" y2="95" stroke="#e94560" stroke-width="1.5" marker-end="url(#arrow1)"/>

<!-- Scan --> <rect x="120" y="75" width="70" height="40" rx="4" fill="#0f3460" stroke="#e94560" stroke-width="1.5"/> <text x="155" y="99" text-anchor="middle" fill="#e0e0e0" font-family="monospace" font-size="10">SCAN</text>

<!-- Arrow 2 --> <line x1="192" y1="95" x2="238" y2="95" stroke="#e94560" stroke-width="1.5"/>

<!-- Vault --> <rect x="240" y="75" width="70" height="40" rx="4" fill="#0f3460" stroke="#e94560" stroke-width="1.5"/> <text x="275" y="99" text-anchor="middle" fill="#e0e0e0" font-family="monospace" font-size="10">VAULT</text>

<!-- Arrow 3 --> <line x1="312" y1="95" x2="358" y2="95" stroke="#e94560" stroke-width="1.5"/>

<!-- Consent --> <rect x="320" y="75" width="70" height="40" rx="4" fill="#e94560" stroke="#e94560" stroke-width="1"/> <text x="355" y="99" text-anchor="middle" fill="#fff" font-family="monospace" font-size="9">CONSENT</text>

<!-- Bottom labels --> <text x="50" y="142" text-anchor="middle" fill="#666" font-family="monospace" font-size="9">Talent</text> <text x="155" y="142" text-anchor="middle" fill="#666" font-family="monospace" font-size="9">Veritone tech</text> <text x="275" y="142" text-anchor="middle" fill="#666" font-family="monospace" font-size="9">Encrypted storage</text> <text x="355" y="142" text-anchor="middle" fill="#666" font-family="monospace" font-size="9">Actor controls use</text>

<defs> <marker id="arrow1" markerWidth="8" markerHeight="6" refX="6" refY="3" orient="auto"> <polygon points="0 0, 8 3, 0 6" fill="#e94560"/> </marker> </defs> </svg>

What makes this interesting from a software perspective is that CAA is essentially building an identity management platform for physical people. The tech partner is Veritone, whose Digital Media Hub handles ingestion, metadata tagging, and access control. Each actor gets what amounts to a private S3 bucket with an OAuth layer — except the asset in question is their own face. The parallels to how we manage API keys, signing certificates, and service accounts are striking. Your likeness becomes a credential. You issue tokens. You revoke access.

There's a subtle but important philosophical shift here too. For decades, the default in Hollywood has been that studios own the footage, the performance, the outtakes — everything captured on their dime. AI flips that. A digital scan isn't footage captured during a specific production; it's a raw asset that can generate infinite future performances. Who should own that? CAA's answer is unambiguous: the talent. The scan doesn't belong to whoever paid for the camera time; it belongs to the person being scanned.

That's not how the tech industry has historically operated. The default posture of most AI companies has been "if it's publicly accessible, we can train on it." CAA's approach is the opposite: nothing gets used without explicit, granular consent. It's a bet that the future of AI-generated media won't be built on scraped data but on licensed, authenticated, high-quality source material. If they're right, having a clean, consent-backed training corpus isn't just ethical — it's a competitive moat.

Of course, there are open questions. What happens to an actor's vault when they die? Can digital doubles be inherited? What prevents a studio from just training a model on publicly available footage and skipping the vault entirely? The legal framework around likeness rights and AI is still being built in real time, and no amount of private-sector infrastructure can substitute for actual legislation.

Still, there's something refreshing about seeing a major institution build consent infrastructure rather than just issuing statements about "responsible AI." The CAA Vault doesn't solve every problem with AI and creative labor, but it solves one concrete one: it gives actors a way to say "yes" or "no" — and have it mean something.

For a deeper dive on the tech side, Variety covered the Veritone partnership back in 2024, and the original Vanity Fair feature by Joy Press is well worth the read.