Summary

  • Imagine a seller recorded in one regional registry, a buyer served by another and a block of addresses that remains globally routable throughout. The commercial handoff may be intelligible to the parties, yet the recognised holder record cannot move cleanly unless both private registries accept compatible evidence and make coordinated entries.
  • The instrument published on 26 October 2018 was AFPUB-2018-GEN-003-DRAFT01. The identifier AFPUB-2018-V4-003-DRAFT01 found in some references is wrong, and the proposal must not be confused with the distinct AFPUB-2019-V4-003 Draft 1-to-4 family.
  • Draft 1 offered a serious bookkeeping architecture: reciprocity, minimum transfer sizes, divided source and recipient checks, transaction documents, a public log and a post-transfer registry update. Those measures could preserve provenance, uniqueness and continuity across two ledgers.
  • Its needs test, origin classification, two-year IPv6 holding period, one-year retransfer bar and legacy-only outbound rule also created private gates. Each gate needed a narrow record-integrity or anti-fraud justification; no clause could confer sovereign, regulatory, punitive or adjudicative power.
  • Draft 1 did not reach consensus, did not become operative and did not transfer any resource. AFRINIC-29 sent it back to the mailing list, and the author’s May 2019 withdrawal concerned Version 2 and closed the later lifecycle without converting Draft 1 into the separate 2019 proposal.

L3 — The handoff between two ledgers

Start at the moment when a transaction is supposed to close. A network operator recorded as the current holder in one regional Internet registry has agreed to transfer a block to an operator whose account and operations sit with another. The addresses do not encounter a physical frontier. Routers can continue to announce and reach them. Customers may see no break in service. Money, contractual promises and operational responsibility can pass between the parties.

Yet the public-facing registration history cannot simply follow unless two distinct registries recognise the evidence, accept each other’s policy conditions and change their records in a compatible sequence.

That is the conflict Draft 1 addressed. It was not principally a problem inside BGP; it was a border between databases. If the source registry accepts the seller’s authority to transact but the receiving registry cannot qualify the buyer, the deal may not acquire a clean recognised endpoint. If the receiving registry is ready but the source registry refuses to close its record, the databases can diverge. A buyer, lender, broker, upstream provider or customer then has to decide which evidence describes the present reality. The resource may remain technically usable while the administrative record stays with yesterday’s holder.

Closing risk rises, operational continuity becomes harder to evidence and the registry becomes less accurate precisely because it will not record what has happened.

The proposal’s identity matters because the surrounding policy history contains a trap. The document submitted by Jordi Palet Martinez on 26 October 2018 was AFPUB-2018-GEN-003-DRAFT01, titled Inter-RIR Resource Transfers Version 1 and framed as a new article 13.0 of the Consolidated Policy Manual. It was not AFPUB-2018-V4-003-DRAFT01, an incorrect identifier found in some references. Nor was it an early version of AFPUB-2019-V4-003, a distinct Resource Transfer Policy family that ran through four drafts and developed its own procedural history. Correcting GEN for V4 is not clerical tidiness. It keeps one instrument’s clauses, status and institutional afterlife from being silently borrowed by another.

Draft 1’s opening rule supplied the bridge’s basic logic. A transfer between AFRINIC and another regional registry would be possible only when that counterpart also offered an inter-RIR transfer path. Reciprocity here was functional. One database should not begin a state transition that the other database has no recognised way to complete. If both registries could receive and close the transaction, each could apply the rules relevant to its side, exchange the necessary evidence and leave the public record in a coherent state.

That condition did not amount to a treaty, and it did not promise universal compatibility. The archived proposal supplied the reciprocity criterion, not a completed bilateral determination for every possible counterpart and resource class. “The other RIR permits transfers” can be the beginning of an interoperability inquiry; it is not its end. Definitions of eligible resources, minimum sizes, need, holding periods, source status and the receiving organisation can still clash even where two rulebooks each contain an inter-RIR section. Draft 1 designed an entrance to a bridge. It did not prove that every lane lined up at the far side.

The remaining clauses reveal how the drafter expected that bridge to operate. First came the resources in scope and the minimum units that could cross. IPv4, IPv6 and autonomous system numbers appeared within the proposed framework. An IPv4 transfer could not be smaller than a /24, while an IPv6 transfer could not be smaller than a /48. Those thresholds can be read as administrative and routing hygiene: the registries would avoid processing fragments below the policy’s chosen floor. But the minima also demonstrate that the proposed service was not a neutral transcription of any agreement the parties might make.

The registry would define which transactions its ledger was prepared to recognise.

Second came an asymmetric rule for outbound movement from AFRINIC. IPv4 addresses and ASNs could leave the AFRINIC service region only when AFRINIC classified them as legacy resources. The contemporaneous staff assessment read the draft as not placing that same legacy-only limitation on IPv6. This distinction meant that origin classification, rather than merely current holdership and transaction evidence, could determine whether an outbound transfer entered the process at all. A legacy IPv4 block might travel; a non-legacy IPv4 block of the same size might not. The technical identifiers could function globally in either case.

It was the private record service that treated their administrative histories differently.

Third, AFRINIC-issued IPv6 carried a time condition. It would be ineligible for transfer until two years after allocation or assignment. A holding period can be defended as a brake on immediate flipping or an opportunity to test whether an initial request was genuine. Yet its mechanics are broader than a check that the present holder exists, that the resource is undisputed and that the transaction document is authentic. The rule would delay a transfer even when all of those settlement facts were clear.

Its legitimacy therefore depended on whether two years was necessary and proportionate to a function the registry properly performed, not on the mere fact that the period appeared in a community policy draft.

Fourth came the recipient’s need. Before the registries completed a transfer, the recipient would have to justify its requirement under the applicable policy. Which registry applied the test depended on direction: recipient qualification remained on the side responsible for the receiving organisation. This allocation had practical sense. The registry that maintained the recipient’s account was best placed to receive forecasts and supporting information in the form its own procedures understood. It also limited the source registry’s need to make a second, potentially inconsistent judgement about an operator it did not serve.

Still, the needs test was not simply a holder-authentication check. It asked why and how much of a resource the recipient should be allowed to receive. That makes it the clearest point at which settlement hygiene could become a private allocation judgement. A predictable need test might constrain fabricated demand or reconcile the transfer with a counterpart’s scarcity rules. An expansive or discretionary test could instead delay a sound transaction, reduce the mobility of scarce IPv4 space and make a registry’s commercial forecast a condition of an accurate public record.

Draft 1 did not generate measured evidence resolving that tension because it never operated.

Fifth came the source-side checks. The relevant registry would verify that the party presenting itself as the source was the current holder in its records. It would also determine whether the resource was in dispute. These are among the proposal’s strongest provisions. A ledger should not be altered at the request of a stranger, and a contested record should not be made to look settled through an ordinary administrative transfer. Confirming the current registered holder protects the chain of provenance. Isolating a dispute prevents the record service from laundering uncertainty into a clean-looking result.

Those checks must be described precisely. Verifying the holder for the purpose of a ledger update is not the same thing as issuing a universal judgement about legal title. Flagging a dispute is not adjudicating it. A registry can decline to present a contested state as administratively final while a competent private process or public court resolves the underlying rights. It cannot obtain judicial power merely because its database is important. Draft 1’s sensible source check was strongest when understood as a narrow refusal to corrupt the record.

Sixth, both parties would submit the legal document supporting the transaction. That requirement connected the proposed registry update to evidence outside the registry. The entry would not create the transaction by itself; it would reflect a transaction that the parties documented. This direction of explanation matters. Commercial and legal reality supplies the basis for changing the ledger. The ledger does not manufacture the parties’ bargain and then confer it upon them.

Authentication can include checking that the document identifies the parties and resources and supports the requested state change, without turning registry staff into a court of general jurisdiction.

Seventh, the parties remained subject to the applicable terms of the registries involved. A two-ledger settlement cannot work if each side ignores the operational requirements of the service responsible for its account. Account validation, request format, evidence handling and coordinated timing all need rules. But “applicable terms” should not be treated as a blank cheque. A contractual or procedural term binds within its proper legal basis and service scope. It does not become legislation for a continent because a registry has written it into a manual.

Eighth and ninth, the draft required publicity and closure. A public transfer log would identify the date, source, recipient, their respective registries and the resource data. The registries would then update their records to reflect the changed holder. Together, these clauses expressed the proposal’s legitimate purpose more clearly than any language of control. The log preserved a trace of movement. The database update made the current state visible. A person conducting diligence could connect the old holder, the transaction and the new holder rather than finding two incompatible claims or a silent break in provenance.

AFRINIC staff recommended using the common transfer-log format already employed by other regional registries. That was practical institutional hygiene. Shared fields and presentation reduce the chance that the same transaction becomes difficult to compare across regions. A common format is a modest form of interoperability: neither registry must surrender its separate system, yet both publish enough structured information for outsiders and one another to understand the state transition. Standardising the record does not standardise ownership law, market value or commercial purpose.

The staff assessment also objected to the proposal’s language of “ownership” and “owner”, preferring “custodianship” and “resource holder”. The correction was valuable because a technical policy should not casually pronounce on title. It reduced the risk that a registry entry would be mistaken for a comprehensive legal determination. But the substitute terminology must not be stretched in the opposite direction. Calling an operator a resource holder does not prove the absence of legally cognisable asset interests, any more than the draft’s use of owner proved an absolute property right everywhere.

The legal character of number-resource interests can vary by jurisdiction and transaction. The registry’s vocabulary cannot decide that question universally.

Tenth, transferred blocks and sub-blocks could not move again for one year. This retransfer bar resembles a cooling-off period. It could make rapid chains easier to audit and could discourage transactions designed only to evade an initial test. It could also restrain a subsequent transaction after the first transfer had been accurately logged and settled. The clause therefore sat on the boundary between provenance protection and market management. If the registries could preserve the full chain through documents, logs and synchronized updates, the additional necessity of a one-year prohibition required its own explanation.

Eleventh, incoming legacy resources would lose legacy status. The rule sought to prevent an administrative category from surviving a movement into the AFRINIC system. It may have simplified the terms under which AFRINIC would maintain the incoming record. It also showed how a registry could change the consequences attached to a resource’s origin label even though the resource itself remained globally usable. The status transition needed to be understood as a condition of AFRINIC’s record service, not as a confiscation of the resource’s history or an assertion that the registry acquired the asset.

The architecture’s twelfth element was the whole sequence rather than a free-standing slogan: compatibility at entry, source and recipient responsibilities divided between the relevant registries, legal evidence exchanged, a public event recorded and both databases brought to closure. The value lay in coordinated state transition. One side could establish who was leaving its ledger; the other could establish who was entering; neither needed to pretend that routing geography or a service-region map was a physical border.

The result, had the policy been adopted and successfully matched with a counterpart, would have been a more reliable description of a private transaction.

The historical record stops short of that result. AFRINIC staff assessed the first draft on 1 November 2018. At AFRINIC-29 later that month, the author presented the IPv4, IPv6 and ASN scope, the legacy-only outbound treatment of IPv4, the /24 and /48 minima, the recipient’s demonstration of need and the aim of maintaining accurate registration. The meeting record says the co-chairs returned the proposal to the Resource Policy Discussion list. It does not report consensus or adoption. AFRINIC’s year-end report still recorded Version 1 as under discussion.

This status boundary is decisive. Draft 1 did not authorise a transfer, did not produce a public log entry and did not create an observed delay, rejection or price effect. It proposed machinery. The sources contain no transactions, volumes, prices, fraud counts, rejection rates or operator losses attributable to it. The economic discussion must therefore describe mechanisms and counterfactuals, not outcomes. A design can be assessed for the frictions it would introduce or remove without pretending that an unadopted text generated data it never had the opportunity to produce.