Summary

  • ARIN’s reviewed but still draft minutes for 18 August 2026 say the Board wanted a more granular Registry Control Plane plan, which was not expected until mid-September.
  • The same minutes say the Board agreed that the President could continue moving forward with hiring an outside consultant, while a special meeting in the week of 14 September was planned to discuss or approve the project.
  • The record does not establish a selected consultant, signed contract, payment, reserve draw or approved project. A compact pre-approval authorization receipt would bound the early work without exposing bids or security architecture.

Two permissions, one incomplete project plan

The useful fact in ARIN’s 18 August Board record is a sequence, not a procurement result.

Staff presented the Registry Control Plane as a response to the registry incident of the previous year. The minutes say immediate process and system mitigations had begun, design work was under way, and an auditor had assessed existing systems against ten forward-looking criteria set by the Board. Staff described an 18-month development effort intended to meet those criteria.

Those statements establish a proposed control target and an expected programme of work. They do not establish that the new control plane exists, that its design has been independently verified, or that the Board had authorized full delivery.

The contracting discussion was similarly preliminary. ARIN’s chief operating officer said the organization was considering contractors so that the initiative would not displace other commitments. Two vendor proposals had been received, with further information from a third vendor. The minutes publish no vendor names, prices, evaluation, recommendation, scope of work or selection.

Board members then asked for clearer milestones and deliverables. Estimates and phased deliverables were said to exist, but the detailed project plan would not be available until the middle of September. At that point the President asked whether ARIN could continue moving forward with hiring an outside consultant. The minutes record Board agreement.

The same record preserves a later gate. A September Finance Committee meeting was to receive a budget and long-term forecast that included the project. A special Board meeting was planned for the week of 14 September, after the Finance Committee meeting, to “discuss/approve” the Registry Control Plane before the regular October meeting.

The slash matters. “Discuss/approve” does not promise that a vote occurred, that approval was certain, or even that a meeting took place on a particular day in that week. The minutes were reviewed, but they remained draft pending later Board approval. Still, the ordering is plain enough to examine: movement toward hiring a consultant was allowed before the detailed plan and before the planned project-decision meeting.

The strongest defence of the early step

The obvious defence is also the strongest one. A Board cannot demand a decision-ready architecture, schedule, cost model and risk register if specialist work is required to produce them. Bounded consulting can be the instrument that converts broad estimates into a plan fit for approval.

This is particularly plausible when an organization is trying to protect ordinary commitments while responding to an operational incident. Bringing in outside capacity may prevent an urgent design exercise from consuming the people who keep registry services running. A consultant can test assumptions, compare delivery paths, identify dependencies and turn an eighteen-month ambition into phased work with named outputs.

So the defensible control is not a ban on spending before a final project vote. Such a ban could make the later vote performative: directors would be asked to approve a plan that no one had been authorized to develop properly. Nor does transparency require ARIN to publish losing bids, security-sensitive diagrams or commercially confidential rates.

The narrower question is what the earlier permission covered. “Continue moving forward with hiring” can describe several materially different states: discussing availability, requesting a refined proposal, negotiating terms, authorizing a small discovery engagement, signing a cancellable advisory statement of work, or committing to production delivery. The public minutes do not locate the permission among those possibilities.

That uncertainty is not proof that ARIN exceeded its authority. It is a reason to preserve the boundary in the record. A reader should be able to distinguish an engagement that creates evidence for the later decision from an engagement that makes the later decision expensive to reverse.

Public policies are comparison surfaces, not verdicts

ARIN publishes an External Contracting Process. It says that contracts worth US$50,000 per annum or more generally follow an RFP process, subject to listed exclusions. It also says ARIN attempts to obtain at least two competitive bids, that the President reviews opportunities with the Board before public announcement, and that opportunities and awards are announced.

The resemblance to the minutes is tempting: two proposals, information from a third vendor, and a Board discussion. But the captured evidence never states the prospective engagement’s annual value, contractual category, exclusion status or procurement stage. It therefore cannot establish that the US$50,000 threshold applied, that a public notice was already due, or that a contracting rule was breached. The policy is useful only because it shows the kinds of checkpoints ARIN already knows how to describe.

The reserve documents require the same discipline. The minutes say management planned to seek a reserve draw over two years, include expenses in the 2027 budget and long-range forecast, and remain above ARIN’s nine-month reserve target. The chief financial officer said ARIN then held thirteen months of reserves.

ARIN’s 2026 budget provides wider context: it began the year with US$36.578 million in investment reserves, projected US$2.010 million of withdrawals, and forecast an almost unchanged year-end balance after earnings and adjustments. Those organization-wide figures do not isolate the Registry Control Plane or show money committed to a consultant.

The Reserve Investment Policy gives prior Finance Committee approval a role when a recommended withdrawal exceeds US$2 million. But nothing in the record establishes that an early consulting engagement was funded by a reserve withdrawal, crossed that amount, or had been executed. The threshold is another conditional boundary, not an accusation.

Give the authorization bridge a receipt

A proportionate public control would be a short pre-approval authorization receipt. It would not reconstruct the missing exhibit or disclose bids. It would state what the Board allowed before the later project gate.

First, the receipt would define scope: discovery, architecture advice, scheduling, costing, risk analysis or another named preliminary task. Second, it would record a maximum commitment or spend and identify who may approve it. Third, it would list the deliverables that must be available for the Board’s later decision.

The receipt should also say whether the work is exploratory, advisory or capable of changing production. It should identify cancellation rights, reusable work product and intellectual-property boundaries, because those terms determine whether the early step remains reversible. It should cite the decision or policy that authorizes the preliminary stage and name the date and agenda of the next gate.

Finally, the later decision should close the loop. Approval, revision, deferral or rejection would supersede the temporary receipt and show which early deliverables were accepted. If the meeting did not occur as planned, the receipt would retain a valid-until date or require a fresh authorization rather than silently expanding.

This is Theo March’s proposed control, not an ARIN feature and not a claim about what was hidden in the Board’s exhibit. Its value lies in restraint. It lets ARIN show that early authority was bounded while keeping vendors, unsuccessful proposals and sensitive architecture out of the public record.

Sources