Summary
- A private membership registry can exercise public-like authority only if mandate boundaries, due process, reviewability, member-power checks, conflict rules, emergency powers, remedies and public-dependency duties keep scarce-address governance inside a nar.
- The most important line in a regional internet registry is not always the line that names a holder of IPv4 space.
The fence inside the registry is the scarce resource
The most important line in a regional internet registry is not always the line that names a holder of IPv4 space. Sometimes it is the line, often hidden in bylaws, policy manuals, staff delegations or board standing orders, that says who may decide, what may be decided, how far a decision may reach, and who can stop it before the record is changed. That line is the institutional fence. In a world of scarce addresses, it can be as economically important as the address record itself.
Imagine the moment not as a courtroom argument but as a registry meeting in which the institution has to write its own limits. One column says allocation. Another says transfer recording. Another says fraud control. Another says member voting. Another says emergency continuity. Another says publication services such as Whois, RDAP, reverse DNS and RPKI. Beside each column someone must write the authorised decision-maker, the evidence required, the appeal route, the conflicts that disqualify a participant, the service that must continue while a dispute is heard, and the remedy if the registry is wrong. That table is dull. It is also constitutional in the only sense that matters for market infrastructure: it turns power into bounded power.
AFRINIC has made the need visible because the African registry sits at the intersection of private incorporation, public-like dependence and scarce-resource economics. It is a membership organisation registered in Mauritius. It administers number-resource records for Africa and parts of the Indian Ocean. Its ordinary functions include registration, member services, public lookup, reverse-DNS support, resource certification and policy implementation. Those mechanics are factual. They do not answer the harder question. When a private membership registry controls recognition over scarce digital infrastructure, what limits prevent it from drifting from record keeper into economic gatekeeper?
The answer is not a written constitution in the national-law sense. AFRINIC is not a state. It does not tax citizens, command police or issue passports. But it does exercise authority that businesses, courts, customers, lenders, brokers, auditors and networks treat as public-like because there is no ordinary substitute. A holder cannot easily switch to another African number registry. A customer cannot route around uncertainty in the AFRINIC record by voting with a consumer wallet. A buyer of a network cannot ignore registry recognition if the transaction depends on the addresses. Exit is constrained. Reliance is broad. Consequence is real. That is enough to require constitutional limits as institutional design.
This is an economic argument, not legal advice or a definitive account of current litigation status. Limits lower the cost of reliance. They reduce the risk premium attached to AFRINIC-administered resources. They prevent institutional language from being used to launder new powers into old mandates. They make courts more willing to preserve registry action where the registry has acted within a narrow role. They make members more willing to participate because participation is not a ceremonial vote over an unbounded machine. Above all, limits protect the ledger from the institution that operates it. A scarce ledger is trusted not because its operator speaks of community, but because the operator cannot easily convert community language into discretionary control over value.
The AFRINIC crisis has supplied too many scenes in which that fence looked weak: public reporting about historical address-record manipulation, the Cloud Innovation dispute, years of litigation in Mauritius, bank and governance pressure, receivership, annulled election attempts, accusations over voting authority, later board reconstruction, continuing court fights, and the recurring fear that continuity language might defend more than continuity. Not every allegation is proved. Not every registry action is suspect. Not every critic is disinterested. But the institutional problem is no longer theoretical. AFRINIC shows what happens when a private registry's economic reach expands faster than the boundary architecture around it.
Private registry authority needs limits because exit is not ordinary exit
The usual discipline on private institutions is exit. If a club behaves badly, members leave. If a vendor is unreliable, customers change suppliers. If a trade association becomes political, firms form another one. A regional internet registry does not work that way. A member may dislike fees, policy choices, staff decisions, election mechanics or litigation posture, but the member still needs a recognised record for addresses and autonomous system numbers. The registry relationship is private in legal form and infrastructural in economic effect.
This hybrid position is what makes constitutional limits necessary. The private form gives the registry flexibility, technical specialisation and member governance. The infrastructural effect gives it power over parties who are not merely voluntary consumers of a service. A resource holder may have customers, financing, leases, routing arrangements, acquisition plans or public-sector contracts tied to recognised address use. A refusal, delay, freeze, adverse status or uncertain transfer path can ripple through those relationships even if the registry insists that it has not touched routing itself.
AFRINIC's official role as a regional registry is therefore only the start of the analysis. It can state the region served, the resources administered and the services provided. That material is useful for mechanics. It cannot be the final authority on the limits of power. Institutions rarely diagnose their own drift well. The relevant question is not whether AFRINIC describes itself as steward, community body or registry. It is whether its decisions are sufficiently bounded, reviewable and accountable that others can treat the record as a dependable public reference rather than a permission controlled by whoever holds institutional office this year.
The absence of ordinary exit changes incentives on both sides. The registry may underprice the harm of overreach because members have few substitutes. Members may over-litigate because a single adverse decision can threaten large value. Critics may build alternative narratives because internal remedies look weak. External bodies may support institutional continuity because they fear fragmentation, even when the disputed power is broader than continuity requires. Each reaction can be rational. Together they create a high-cost equilibrium: more legal spending, more defensive contracting, more suspicion, more delay and less reliance on the public record.
Constitutional limits are a way to change that equilibrium. They say that a registry may correct records, prevent duplication, require verified authority, protect publication services and respond to fraud, but it may not treat every commercial disagreement, regional-development concern, leasing debate or policy preference as a warrant for unbounded enforcement. They say that member voting may govern the institution, but voting authority must itself be verified and challengeable. They say that emergency guardians may preserve services, but emergency power must expire, report and remain tied to continuity. They say that courts may review disputed power without being accused of attacking the internet. Limits turn exit from a desperate lawsuit into a lower-cost expectation of procedure.
This matters most for smaller operators. A large cloud platform can diversify across registries, hire counsel and absorb delays. A small African network may have one registry relationship and little balance-sheet room for uncertainty. If the registry's powers are unclear, the smaller operator pays in financing cost, customer confidence, delayed expansion and fear of routine updates. Constitutional design is therefore not a luxury for governance theorists. It is a market-access condition for the very networks a regional registry is supposed to serve.
Mandate boundaries stop stewardship from becoming mandate laundering
The first constitutional limit is the mandate boundary. It should define the registry's legitimate field of action before a controversy arises. A regional registry needs authority to keep number resources unique, maintain accurate records, verify holder authority, publish reliable registration data, support reverse DNS and routing-security services, process allocations and transfers under adopted rules, collect fees, investigate fraud and record disputes. Those are core functions. They are powerful, but they are recognisable.
Mandate laundering begins when those functions are stretched into a broader claim of institutional preference. A rule adopted to prevent duplicate claims becomes a tool to judge business models. A record-integrity review becomes a general inquiry into whether a holder's customers are morally acceptable. A regional-stewardship phrase becomes a capital-control device. A continuity warning becomes protection for every decision of the incumbent institution. A community statement becomes evidence that affected resource holders have no reliance interest. The language sounds familiar. The power has changed.
AFRINIC's post-exhaustion setting is fertile ground for that drift. IPv4 scarcity turned administrative recognition into a valuable input. When a registry approves, delays or refuses a transfer, it affects liquidity. When it interprets use conditions years after allocation, it affects reliance. When it links membership standing to high-value resource treatment, it affects bargaining power. When it treats leasing or market movement as evidence of illegitimate use without a clear adopted rule and review route, it becomes a gatekeeper over capital rather than a keeper of records.
The answer is not to deny the registry all discretion. Some discretion is unavoidable because facts are messy. Old records may be incomplete. Corporate succession may be hard to prove. Dormant holders may have vanished. Signatures may be forged. Court orders may be unclear. Fraud may be real. A rigid registry would be dangerous in a different way. The constitutional answer is to tie discretion to a named function. If the problem is authenticity, the remedy should verify authority. If the problem is duplicate recognition, the remedy should isolate the conflicting claim. If the problem is contact failure, the remedy should restore contactability. If the problem is security publication, the remedy should preserve reliable publication. The remedy should not leap from a narrow defect to control over the holder's entire economic strategy.
Mandate boundaries also protect the registry. AFRINIC's long dispute with Cloud Innovation showed how a resource review can escalate into litigation that threatens institutional capacity. One need not accept either side's full account to see the incentive problem. A registry that claims broad discretionary power over economically valuable resources invites resource holders to test the boundary in court. A registry that defines its power narrowly, writes reasons and preserves review can defend itself as infrastructure rather than as a private governor of value.
The practical test is simple: can the registry state the power it is using without resorting to vague words such as community, stewardship or public interest as substitutes for criteria? Those words may express goals. They should not be the operating warrant. A constitutional registry can say, "This record cannot be changed because the signer's authority is unverified." It should be far more cautious about saying, "This resource cannot move because the institution dislikes the market consequence." The first protects the ledger. The second risks mandate laundering.
Scarcity turns unconstrained discretion into a regional risk premium
IPv4 scarcity is the economic reason that constitutional limits cannot be postponed. In an abundant era, many registry mistakes were inconvenient but not capital-changing. A delayed allocation could be replaced by another request. A policy argument could proceed without turning every sentence into market value. Exhaustion changed the meaning of registry recognition. Addresses became operational inputs, balance-sheet-like positions, leaseable capacity, acquisition concerns and litigation prizes. The registry record became part of price formation.
Risk premiums appear when market participants cannot predict how power will be used. A buyer discounts a block if transfer recognition may be delayed by broad discretion. A lender discounts an address-dependent business if registry standing can shift without timely review. A customer discounts an operator if reverse-DNS, RPKI or public records may be caught in unrelated disputes. A member discounts governance if a board's authority is shadowed by unresolved voting challenges. The premium is not always visible as a line item. It appears as wider warranties, escrow demands, legal opinions, slower closing, higher collateral haircuts, redundant sourcing and reluctance to invest.
AFRINIC's public history has increased that premium because several kinds of uncertainty arrived together. The 2019 reporting by KrebsOnSecurity about alleged historical address manipulation raised provenance concerns. The Cloud Innovation dispute raised mandate and enforcement concerns. Court proceedings and bank pressure raised continuity concerns. Receivership raised emergency-governance concerns. The 2025 election disputes raised member-authority concerns. Later reporting about board recovery and renewed litigation raised the question of whether formal governance restoration was enough to restore market confidence. Each episode is different. Economically, they all teach counterparties to ask how bounded the registry really is.
Scarcity also changes distribution. A rule that limits transfers may be described as protecting African resources, yet it can reduce the value of resources already held by African operators and discourage transparent supply from entering formal channels. A broad resource review may be described as protecting community stewardship, yet it can make honest holders afraid to update records, lease capacity openly or cooperate with verification. A strict voting intervention may be described as protecting election integrity, yet it can damage legitimacy if the reasons and authority are unclear. In each case the institutional claim may have a defensible core. The constitutional problem is whether the power is limited enough to avoid becoming a tax on ordinary reliance.
The region pays the premium through weaker markets and higher operating costs. If the formal registry path is unpredictable, parties build informal arrangements. Leasing becomes harder to see. Successor records stay stale. Transfers avoid disclosure. Brokers gain value from private knowledge of institutional habits. Courts become the default review route. Members spend more time on defensive politics. These are deadweight costs. They do not improve connectivity. They simply redistribute attention from networks to institutional risk.
Constitutional limits reduce the premium by making registry risk legible. They do not guarantee that every holder wins. They guarantee that the holder can know the rule, the evidence, the decision-maker, the review route and the preserved operating state. That predictability makes an adverse decision less contagious. The market can distinguish a forged document from a curable contact defect, a court restraint from a policy disagreement, a disputed transfer from a general threat to all services. Scarcity makes that distinction valuable.
Due process is one wall, not the whole constitution
Due process matters because registry decisions can destroy value before final review. Notice, reasons, cure periods, stays and appeal rights are essential safeguards when a registry proposes a high-consequence action. But due process is only one wall in the constitutional architecture. It protects the holder after a decision is proposed or made. It does not, by itself, define the mandate, separate institutional roles, check member power, disclose conflicts, constrain emergency authority or align remedies with economic harm.
This distinction matters for AFRINIC because a narrow focus on appeals can make the deeper design problem look smaller than it is. If a registry's mandate is too broad, an appeal merely reviews overbroad power. If policy, administration and enforcement are fused, an appeal may return the file to the same institutional culture that created the problem. If board legitimacy is contested, an appeal body created by that board may not convince the market. If emergency authority is vague, a stay may preserve too little or too much. Procedure after the fact cannot substitute for limits before the fact.
Still, due process is indispensable. A holder facing resource review, transfer refusal, adverse status, publication-service interruption or termination needs to know what is alleged, what fact is missing, what rule applies, what can be cured, what will continue and who can review the decision. A court evaluating the registry later needs the same record. Counterparties need it to price risk. The wider community needs it to distinguish enforcement against real defects from institutional pressure against disliked economic behaviour.
AFRINIC's crisis shows why the wall must be strong. When a registry is emerging from allegations about historical records, it must investigate without turning every holder into a suspect. When a major resource dispute is in court, it must preserve disputed state without making unrelated services hostage to the litigation. When member elections are challenged, it must verify authority without letting emergency administrators become permanent political actors. Each task needs notice and reasons, but each also needs a separate boundary rule.
The constitutional approach therefore treats due process as the procedural expression of deeper limits. Mandate boundaries tell the registry what it may decide. Due process tells the affected party how that decision must be made. Reviewability tells the market that the first decision is not final merely because the institution made it. Separation of roles tells participants that the same actor did not write the rule, bring the charge, decide the file and execute the sanction. Transparency tells outsiders what category of power was used. Remedies tell everyone what happens if the registry was wrong. The walls work together or they do not work.
For resource holders, this means procedural rights should not be framed as favours granted by the registry. They are part of the price of monopoly recognition. For AFRINIC, this means due process is not a concession to hostile litigants. It is how the registry proves that it remains a ledger institution rather than a low-liability gatekeeper over scarce capital.
Reviewability lowers the cost of institutional error
Every registry will make mistakes. A document will be misread. A company name will be confused. A court order will arrive with ambiguous scope. A staff member will apply an old rule too broadly. A resource holder will omit evidence that later proves decisive. A proxy will look valid until the alleged issuer challenges it. A fraud signal will be serious but incomplete. The constitutional question is not whether error can be abolished. It is whether error can be corrected before it becomes an irreversible economic event.
Reviewability is the answer. It should exist at several levels. First, a different staff reviewer should be able to reconsider a decision quickly and with authority to narrow or suspend the consequence. Second, high-consequence decisions should be reviewable by an independent mechanism that is not merely the original institution repeating itself. Third, courts must remain available for questions that exceed registry competence, such as corporate control, contractual rights, insolvency authority or claims of unlawful conduct. Each level should preserve the last verified operational state where possible.
Reviewability lowers risk premiums because it changes the expected loss from error. If a transfer refusal can be explained, corrected and reviewed in weeks, parties price delay. If the refusal can only be challenged through years of litigation, parties price existential uncertainty. If a resource-recovery notice is stayed while an independent body reviews evidence, customers can continue. If it takes effect before review, the holder may seek urgent court relief and the dispute becomes institutional warfare. A review system is therefore cheaper than the litigation it prevents.
AFRINIC's recent history makes reviewability more than a good-governance preference. The institution has faced court scrutiny, receivership and election disputes precisely because ordinary governance could not contain conflict. That does not mean courts should run the registry. It means that the registry needs internal and independent review strong enough that courts are not the only credible backstop. A court is a necessary constitutional limit from outside. A registry that wants institutional deference should build limits inside.
The design should distinguish review from lobbying. Review is evidence-based, recorded and bounded by criteria. Lobbying is private pressure on staff, board members, receivers, committees or external supporters. A registry under stress is vulnerable to the second because parties believe private access may beat formal procedure. Strong review reduces the value of private access. If everyone knows how to challenge a refusal, obtain a stay, submit evidence and receive reasons, the broker or insider who claims special access becomes less valuable.
Reviewability also disciplines official supporters. When ICANN, the NRO or other coordination bodies speak about registry continuity, their statements carry weight. But continuity support should not become endorsement of every disputed decision. A transparent review path lets outside actors support the function without prejudging the file. They can say: preserve publication, records and uniqueness; let the bounded review mechanism decide whether the adverse act was within mandate. That distinction is crucial if continuity is to protect the ledger rather than the gatekeeper.
Policy, administration and enforcement must not sit in the same hand
Separation of powers sounds grand, but in a registry it means something practical. The people or bodies that make general policy should not decide individual enforcement files in private. The staff who administer records should not rewrite policy through case-by-case pressure. The board that oversees budgets and executives should not become an escalation desk for particular resource outcomes. The enforcement function should not control the appeal route. The election authority should not be casually blended with resource authority. Each separation reduces the chance that institutional preference becomes ledger state.
AFRINIC's governance stress shows why these separations are economic controls. When a board is weak or absent, staff decisions can appear too powerful. When a receiver is appointed, emergency preservation can appear to carry policy authority. When elections are disputed, every subsequent board action may be discounted. When a litigant is also a large resource holder or a visible critic, routine decisions can be read as retaliation or favour. When policy language is broad, staff discretion becomes a market force. Separation does not remove all suspicion, but it makes each suspicion testable.
The policy function should set prospective rules through a visible, participatory path. It should not be used to punish past conduct that was not clearly prohibited when reliance formed. Retroactive reinterpretation is one of the most dangerous forms of mandate drift because it converts old administrative language into new economic control. The more valuable IPv4 becomes, the more tempting this becomes. A constitutional registry uses anti-retroactivity as a market-stability device: new conditions can govern new grants or future conduct, but settled reliance cannot be reopened casually.
The administrative function should keep the record accurate and services running. It should verify documents, maintain contacts, record transfers that meet criteria, preserve publication services and classify disputes. It should be strong where evidence is clear and modest where the question belongs elsewhere. Staff should have authority to reject incomplete files, freeze disputed changes and require verification. They should not become judges of whether a lawful business model is socially admirable.
The enforcement function should be bounded by written triggers and proportional remedies. Fraud, forged authority, duplicate claims, serious security threats and clear rule breaches need enforcement. But enforcement should not contaminate unrelated services or become a way to pressure a holder in a wider conflict. If a transfer document is defective, pause the transfer. If voting authority is disputed, pause the vote tied to that authority. If a public claim is misleading, address the claim. Do not treat every narrow defect as permission to threaten the whole resource position.
Appeal and review should stand apart from all three. A reviewer who depends on the same office that made the decision cannot restore confidence in a high-value file. Independence need not be theatrical. It can be a standing panel, contracted review body, court-supervised expert or other mechanism with technical and legal competence. What matters is that the affected party and the market can see that the first-line institution did not have the last word over its own power.
Member power needs checks because membership is not a public electorate
Member governance is important, but it is not magic. RIRs often rely on the idea that members control the institution through elections, meetings and policy participation. That model can support legitimacy only if member power is real, representative and protected from manipulation. In a low-participation association with valuable resources at stake, member governance can also be captured by organised minorities, proxy machinery, credential abuse, factional coalitions or state-linked influence.
AFRINIC's election troubles made this risk concrete. Public reporting in 2025 described a suspended and later annulled election amid allegations concerning powers of attorney and voting authority. Some reports said representatives arrived to find that votes or authority had been claimed in ways they contested. Later reporting described a board election that moved the institution toward recovery, while critics continued to question aspects of the arrangements and surrounding litigation continued. The cautious conclusion is not that every allegation is established. It is that voting authority became a decisive institutional asset.
Voting authority and resource authority share the same constitutional nerve. Both require the registry to know who may speak for a member. The same weaknesses that permit a questionable proxy can permit a questionable record update, transfer request, litigation instruction or policy mandate. If the institution cannot verify who speaks for a member at the voting desk, the market will question whether it can verify who speaks for a holder in a high-value resource file.
Checks on member power should therefore be rigorous. Proxy instruments should have direct confirmation to the purported issuer through a verified channel, limits on concentration, challenge windows, revocation paths and public aggregate reporting. Credentials for voting should be segmented from credentials for resource administration. Member categories should be reconciled across corporate law, bylaws, resource accounts and voting rules. Election vendors, receivers, staff and board candidates should disclose conflicts. Results should be accompanied by enough explanation that losing sides can see whether the authority chain was tested.
This is not anti-democratic. It is the condition for credible membership. A member vote that can be manufactured through weak authority verification is not community self-governance; it is a market for control of an institution that controls scarce records. Conversely, a vote that is hard to counterfeit, auditable and challengeable can give a board the legitimacy needed to make ordinary decisions without every act being discounted.
Member checks also protect against the opposite problem: excessive external guardianship. When a registry is paralysed, governments, continental organisations, global coordination bodies and courts may be tempted to support a rescue. Some support may be necessary. But rescue cannot replace member legitimacy permanently. A constitution for a private registry should make clear when emergency participation ends and member control resumes. Otherwise continuity becomes a bridge to a different form of capture.
Transparency must reveal constraints, not narrate virtue
Transparency is often confused with messaging. A registry under criticism publishes statements about its mission, meetings, community, continuity, court victories or resilience. Some of that communication may be necessary. It is not the transparency that lowers economic risk. Market participants need to know how power is constrained, not merely how the institution describes itself.
Useful transparency is categorical. It tells members how many high-consequence actions occurred, what types of decisions were made, how often transfers were refused and why, how many disputes were recorded, how many appeal requests were filed, how long reviews took, how many emergency holds were used, how many proxy instruments were challenged, what conflicts were declared, and what services were protected during litigation or receivership. Sensitive details can be redacted. Categories should not be hidden.
AFRINIC's public controversies show the cost of transparency gaps. Address-manipulation allegations raised questions about historical provenance. Resource disputes raised questions about enforcement scope. Election disputes raised questions about authority verification. Receivership raised questions about emergency mandate. Winding-up or continuity-related litigation raised questions about what belongs to the registry corporation and what belongs to the public coordination function. Each gap invited competing narratives. The cure is not one more narrative. It is evidence architecture.
Transparency must also label the status of claims. Allegation, investigation, interim order, final decision, member complaint, staff finding, court filing, press report and board resolution are different. A registry that blurs them can turn accusation into fact or procedure into vindication. Critics who blur them can do the same. Constitutional transparency requires disciplined labels because each status carries different economic weight. A resource under allegation is not a resource adjudged defective. A disputed proxy is not a proven forgery. A court permission to intervene is not a final ruling on the merits. A receiver communication is not a permanent constitutional settlement.
The registry should publish constraints on itself. What actions can staff take without board approval? What actions can the board not take in individual files? What does a receiver or emergency officer need court permission to do? What services continue during disputes? What evidence triggers a freeze rather than a revocation? What is the review timetable? What data is escrowed? What audit has been performed? These disclosures reassure the market because they make it possible to predict what will not happen.
Virtue narratives can even raise suspicion when they substitute for constraints. A phrase such as "acting in the public interest" is not enough if the public cannot see the rule. A phrase such as "protecting the community" is not enough if the affected member cannot see the evidence. A phrase such as "ensuring continuity" is not enough if continuity includes discretionary enforcement. The constitutional registry is transparent about its limits first and its virtue second.
Conflict rules protect the ledger from private conversion of public trust
Scarce records attract private incentives. Staff may know which dormant records are weak. Brokers may know which procedural channels are faster. Board members may have relationships with resource holders, governments, vendors, campaign groups or litigants. Election participants may hold proxies, paid mandates or policy stakes. Consultants and lawyers may advise the registry while having interests in wider disputes. None of this proves misconduct. It proves the need for conflict rules.
Conflict rules are constitutional because they decide whether public-like trust can be converted into private advantage. A registry record has value because others believe it is neutral, accurate and not for sale through influence. If participants believe that a relationship with staff, a board faction, a receiver, a broker or an external sponsor can improve a resource outcome, the official record loses some of its market quality. It becomes a negotiated permission rather than a public reference.
AFRINIC's reported address-record controversy is the starkest background. KrebsOnSecurity's 2019 account described allegations that valuable African IPv4 space tied to dormant or defunct entities had been manipulated through companies associated with a former AFRINIC insider. The report was not a final adjudication of every claim. Its institutional lesson is still powerful: a registry must assume that privileged knowledge of stale records can have market value. That assumption should produce controls, not denial.
Conflict rules should cover staff, directors, committee members, election officials, receivers, vendors, consultants and advisers. They should require periodic declarations, matter-specific checks, recusal records, cooling-off rules for sensitive functions, restrictions on private escalation channels, and special controls for dormant records, transfer files, dispute-state changes and election proxies. They should also apply to people advocating against the registry where they seek formal roles. A critic with a commercial interest is not disqualified from all participation, but the interest should be visible where it affects decisions.
The board-staff boundary is especially important. A board may set policy and oversight, but it should not quietly steer a live resource file. If a director receives a complaint or lobbying request, it should be logged and routed through the formal channel. If a board committee reviews a class of decisions, its mandate should be public and non-case-specific unless a written procedure says otherwise. If a director has a relationship with a party, recusal should be recorded. These are not courtesies. They are market controls.
Conflict rules also protect legitimate enforcement. If AFRINIC takes action against a real fraud risk, the decision will be more credible if the conflict trail is clean. If it refuses a transfer for genuine evidence reasons, the refusal will be less likely to be seen as factional. If it restores governance after receivership, the new board will be less discounted if its election authority and campaign relationships are documented. Conflict discipline is not a concession to cynics. It is how an institution avoids feeding them.
Emergency powers should preserve functions without creating sovereignty
Every constitution needs emergency rules because institutions fail in real time. A registry may lose a board, face an account freeze, discover forged documents, confront a security incident, receive conflicting court orders or need a receiver to keep services alive. AFRINIC has experienced several of these stresses. The lesson is not that emergency powers are illegitimate. The lesson is that emergency powers are dangerous unless they are narrow, temporary, reported and tied to named continuity functions.
An emergency power should begin with the service being preserved. Is the registry maintaining RDAP and Whois availability? Reverse DNS? RPKI publication? Billing needed to keep infrastructure paid? Member support? Evidence preservation? Election logistics? Litigation compliance? Each function has a different authority and risk. A power to pay hosting bills is not a power to alter transfer policy. A power to preserve the last verified registry state is not a power to settle a commercial dispute. A power to organise an election is not a power to convert emergency authority into a political mandate.
Receivership illustrates the distinction. A court-appointed receiver can be necessary when ordinary governance cannot act. The receiver can preserve assets, keep staff paid, organise elections, communicate with members and maintain services. But receivership concentrates power precisely because ordinary checks are weak. It must therefore come with mandate mapping: what the receiver can do alone, what requires court approval, what requires member consultation, what expires when a board returns, what decisions are only temporary and what record changes are outside the emergency role.
Emergency authority should also report. A crisis often requires speed, but speed should leave a log: who acted, why, under what power, which services were affected, which alternatives were considered, which parties were notified, what review is available, and when the action expires. That log protects the emergency actor from later suspicion and protects members from quiet drift. An emergency without records is a new source of legitimacy loss.
The most dangerous emergency claim is that continuity requires institutional sovereignty. It does not. Continuity requires the preservation of functions: uniqueness, registration accuracy, public lookup, reverse DNS, RPKI, ordinary support, evidence and dispute isolation. It does not require every decision of the incumbent institution to be insulated from challenge. A court can restrain an overbroad enforcement act while preserving publication services. Members can challenge an election while routine technical operations continue. External bodies can support data continuity without endorsing contested policy positions. The function and the institution are related, but not identical.
AFRINIC's future resilience depends on making this distinction routine. If emergency language is used to defend all institutional choices, critics will treat continuity as a pretext. If emergency powers are too weak, courts and markets will fear service collapse. The constitutional middle is strong continuity with weak discretion: keep the ledger alive, keep the services paid, keep the records coherent, keep the evidence intact, and do not use the emergency to decide more than the emergency requires.
Remedies and liability must align authority with consequences
Power without remedy is a subsidy to error. A registry that can impose high-consequence decisions while disclaiming meaningful responsibility creates a predictable incentive problem. It may not intend to overreach. It may even act with public motives. But if the institution bears little cost when it is wrong, while holders, customers and counterparties bear large costs, the market will price that asymmetry.
The constitutional answer is not to make AFRINIC an insurer of every commercial loss. That would be unrealistic and might make ordinary registry service impossible. The answer is to align remedy with the kind of power exercised. If the registry keeps to narrow record functions, remedies can focus on correction, review, cost shifting for unreasonable conduct and preservation of services. If the registry claims broader enforcement over valuable resources, then stronger remedies, stronger independence and stronger liability discipline are needed. The broader the discretion, the greater the accountability.
Remedies should begin with preservation. Before damages are debated, the system should prevent avoidable loss by staying severe action, preserving the last verified operational state, isolating disputed changes and keeping public services available. This is cheaper than later compensation. It also avoids turning customers into collateral damage. A registry should rarely need to break continuity first and explain later.
The second remedy is correction. If a record was changed on weak authority, restore the prior state or mark the dispute while facts are resolved. If a transfer was wrongly refused, provide a fast path to reconsideration and state what delay has occurred. If a proxy was wrongly accepted, explain how the vote or decision was affected. If a conflict was missed, redo the decision with a clean reviewer. Correction is not humiliation. It is an infrastructure habit.
The third remedy is reasoned accountability. The registry should publish aggregate outcomes and, where appropriate, redacted explanations of high-consequence reversals. Courts and independent reviewers should be able to impose costs or procedural consequences when either the registry or a holder acts in bad faith. A holder should not be rewarded for forged documents or obstruction. A registry should not be rewarded for vague threats or category confusion. Remedy discipline must run both ways.
The fourth remedy is structural. If repeated errors occur in one category, the rule or delegation should change. If transfer refusals are frequently overturned, the criteria are unclear or the staff training is weak. If election proxies keep failing, the verification system is defective. If emergency actions keep exceeding mandate, the emergency rules are too loose. Constitutional governance treats repeated error as evidence about institutional design, not merely as isolated embarrassment.
This alignment of authority and consequence is what gives courts confidence. A court is more likely to respect a registry decision if the decision sits inside a visible system of reasons, review, stay, conflict control and correction. A court is more likely to intervene if the registry appears to combine large power with small responsibility. AFRINIC's litigation history should make that lesson unavoidable. The way to reduce court involvement is not to insist that courts defer. It is to build a constitutional record that earns deference.
Public-dependency duties make continuity a limit on power
Continuity is often invoked as a reason to protect the registry. It should also be a limit on the registry. Because public and private networks depend on registry services, the institution has a duty not to use those services as leverage in disputes beyond their function. RDAP, Whois, reverse DNS, RPKI, contact records, billing channels and member support are not bargaining chips. They are the infrastructure expression of the registry's public-like role.
This duty changes how disputes should be handled. If a holder's transfer file is defective, pause the transfer, not unrelated publication services. If a member's voting authority is disputed, isolate that vote, not the member's technical records. If a resource is subject to a court restraint, preserve the last verified state and state what actions are blocked. If a holder is alleged to have committed fraud, protect evidence and prevent contested movement, but do not damage customers or relying networks unless a narrow emergency requires it. Public dependency makes proportionality operational.
AFRINIC's situation is particularly sensitive because institutional disputes have repeatedly threatened to spill into continuity concerns. Reporting has described bank pressure, receivership, election breakdown, legal disputes and external interventions. The temptation in such a setting is to treat any challenge as a continuity threat. That is too broad. Some challenges threaten continuity. Others test authority. A constitutional registry welcomes the distinction because it allows legitimate restraint without service collapse.
Public-dependency duties also constrain external actors. ICANN, the NRO, other registries, governments and industry groups may have reasons to prevent fragmentation or operational failure. But support for continuity should be framed around functions, not unconditional institutional endorsement. They can help preserve data, services, technical expertise and transition planning without deciding every dispute in favour of the incumbent. If external support appears to protect discretionary power rather than public dependency, it may worsen the legitimacy problem it seeks to solve.
For members and critics, the same duty imposes restraint. A lawsuit, campaign or market challenge should not seek to paralyse ordinary registry services as leverage if a narrower remedy can protect the right at issue. A party that claims to defend resource-holder interests while damaging publication services or broad member operations weakens its own constitutional case. Limits bind everyone who touches the shared dependency.
The strongest continuity rule is therefore symmetrical: the registry may not use continuity as immunity, and challengers may not use fragility as leverage. The ledger must remain accurate, public services must remain coherent, and disputes must be isolated. This rule is not sentimental. It is the economic foundation of a registry whose records are relied upon by parties far beyond the immediate fight.
AFRINIC's lesson is a limited registry, not a louder institution
AFRINIC's crisis is often narrated as a contest over who should control the institution: the incumbent registry, dissident resource holders, courts in Mauritius, a receiver, a reconstituted board, regional political actors, global coordination bodies, or the member community. Control matters. But the deeper lesson is that a registry administering scarce resources should be less worth controlling. Its constitutional limits should make the institution powerful enough to keep records reliable and too bounded to convert institutional victory into economic command.
That is the paradox of registry legitimacy. The more valuable IPv4 becomes, the stronger the temptation to fight over the registry. Yet the registry is most legitimate when it offers the least discretionary prize. If policy is prospective, administration is evidence-bound, enforcement is proportional, appeals are credible, conflicts are visible, emergency powers expire, member authority is verifiable and continuity services are protected, then capturing the institution yields less private gain. The ledger becomes safer because the operator is fenced.
This does not mean AFRINIC should be weak. A weak registry cannot prevent duplicate claims, forged authority, false records, abuse-contact decay, broken publication services or opportunistic transfers. It means AFRINIC should be strong in narrow ways. Strong at verifying authority. Strong at keeping public records available. Strong at maintaining reverse-DNS and RPKI continuity. Strong at detecting provenance defects. Strong at stating reasons. Strong at preserving the last verified state during disputes. Strong at correcting itself. Weak only where a private membership body should be weak: in its ability to decide broad economic outcomes without clear authority and review.
The constitutional package is therefore practical. Mandate boundaries say what the registry may do. Due process says how adverse decisions are made. Reviewability says how error is corrected. Separation of policy, administration and enforcement prevents role fusion. Member checks protect the vote from becoming a market for control. Transparency reveals constraints rather than virtue. Conflict rules prevent private conversion of public trust. Emergency powers preserve functions without creating sovereignty. Remedies align authority with consequence. Public-dependency duties keep continuity from becoming immunity.
AFRINIC is not the only registry that needs these limits, but it is the registry where the cost of missing limits has become easiest to see. Reported corruption concerns, litigation, receivership, election disputes, IPv4 scarcity and institutional-continuity debates have all pointed to the same question: can a private membership registry remain a trusted ledger when the record it maintains has become capital-like, contested and hard to replace? The answer depends less on louder claims of legitimacy than on enforceable boundaries.
The market will not wait for an official philosophy of number-resource constitutionalism. It will price what it sees. If AFRINIC's decisions look bounded, reviewable and evidence-based, the risk premium falls. If decisions look broad, politicised, opaque or insulated by continuity rhetoric, the premium rises. The premium is then paid by African networks, resource holders, customers, buyers, lenders and the institution itself.
A good registry constitution would not make AFRINIC dramatic. It would make it boring again. Members would know how authority is verified. Holders would know the limits of enforcement. Courts would know which functions must continue. Staff would know which decisions require escalation. Buyers and lenders would know how disputes are classified. External bodies would know what they are preserving. Critics would know where to challenge. Most importantly, the public record would remain trusted because the institution operating it could not easily exceed its fence.
That is the economics of constitutional limits for RIRs. The constitution is not a parchment, a slogan or a claim to sovereignty. It is the set of enforceable restraints that makes reliance rational when exit is weak and scarcity is high. AFRINIC's crisis has shown what happens when those restraints are incomplete. Its recovery will be measured not by how loudly it asserts authority, but by how clearly it limits itself.