Summary

  • On 9 November 2021, AFRINIC published Policy Compliance Dashboard Draft 2 and a staff assessment that warned against allowing dashboard output to modify RSA renewal or termination.
  • The warning identified a decisive boundary: a private registry may expose a possible discrepancy, but its display cannot create contractual meaning or supply the authority for a consequential decision.
  • A useful dashboard should preserve sources, dates, governing versions, uncertainty, member responses and correction history, while every renewal or termination question begins in a separate, authorised process.
  • This separation matters because an unexplained status can influence staff attention, diligence and continuity planning even before formal action, while the RSA places potentially severe operational consequences beside a very small liability ceiling.
  • The sound design is neither opaque manual administration nor self-executing classification. It is a two-track system in which observability improves and adjudication remains independent, reviewable and incapable of being triggered by software alone.

The institutional brake hidden in a useful idea

On 9 November 2021, AFRINIC placed two things into the public record at once. The first was AFPUB-2021-GEN-003-DRAFT02, the second draft of a proposal for a Policy Compliance Dashboard. It envisaged giving the relevant member visibility through MyAFRINIC. The second was a staff impact assessment. That assessment identified a legal conflict if the displayed output were used to modify renewal or termination under the Registration Service Agreement, and recommended that the dashboard remain a visibility tool. The proposal supplied the instrument; the assessment supplied its limit.

That pairing is unusually revealing. Institutions normally sell information systems as efficiency projects: consolidate records, expose discrepancies, shorten support exchanges, help users act earlier. All of those ambitions can be legitimate. Yet a status display in a registry account does not sit in an ordinary consumer setting. It sits near a contractual relationship governing access to registry services and the recognised continuity of Internet number resources. A label can therefore acquire weight far beyond the data from which it was made. The staff warning recognised that danger before any demonstrated outcome had to expose it.

The narrow point deserves discipline. Publication of Draft 2 did not make it adopted policy. A staff assessment was not a judgment by a court or an amendment to a contract. The available record does not establish that the proposal entered into force, that any member saw a resulting classification, or that renewal, termination, services or resources were affected. It does not establish a numerical result, a common colour system, a weighted formula or an automated decision. “Dashboard score” is a convenient shorthand for the title, not a finding about the mechanics.

In analysing the design, status, indicator, flag, classification and output are the more accurate terms.

Those limits do not make the episode trivial. Institutional power is often allocated before it is exercised, in the specification of what a system may treat as an input and what may follow from an output. Draft 2’s staff assessment confronted that allocation directly. It said, in effect, that a tool for making a claim visible could not be turned into the legal parent of an RSA consequence. The distinction is not between analogue virtue and digital danger. It is between knowing something and being authorised to decide what that knowledge means for another party.

AFRINIC has a useful, narrow role. It is a private, membership-based technical number registry and coordinator incorporated under Mauritian law. Its proper work includes maintaining unique records, contact and service information, security assertions, transfer records, fraud-resistant changes and correction routes. None of those functions makes it a state, legislature, regulator, police force, prosecutor, punitive authority, confiscator or court. Technical dependence does not manufacture public power. Nor do staff expertise, board attention, a participatory policy process or repeated appearance of a status on an official page.

This is the bookkeeper boundary developed in Heng Lu’s analysis of registry authority. A ledger can be indispensable without becoming sovereign. Its accuracy can support transactions without allowing the keeper of the ledger to invent the terms of those transactions. The related warning against turning registries into enforcers is functional, not rhetorical: when the same institution observes a possible problem, frames the accusation, controls the evidence surface and initiates the consequence, administrative convenience collapses roles that should remain separate.

The risk is greatest when the institution controls an operational dependency that the affected party cannot replace quickly.

The observation itself can still be valuable. Suppose AFRINIC’s records suggest that a member detail no longer matches an expected condition. A well-made account card could identify the data source, the time of collection, the policy or RSA version staff believe relevant, the observed fact, the uncertainty surrounding it and the person or team able to correct it. It could retain the member’s answer and show whether the matter was corrected, disputed or sent for separate review. That information could reduce surprise and help both sides find the same record.

But the card would remain a claim about evidence. It would not establish that a contract term applied to the particular party. It would not decide which version of the RSA governed, whether the observed fact amounted to non-performance, whether notice was adequate, whether an answer cured the matter, or whether an authorised person could take a consequential step. Software can order propositions. It cannot make them legally true.

The separate RSA matters for exactly this reason. The official agreement in the record describes an annual service relationship linked to applicable adopted policy. It contains written-notice and response-or-cure logic. It also describes immediate revocation of number resources and cessation of services upon termination or expiry without liability. At the same time, it limits AFRINIC’s liability to the greater of the fees paid over the preceding six months or USD 100. No clause number needs to be invented, and no claim should be made that one version applies identically to every possible member.

The relevant point is structural: the agreement has its own sources, sequence and stakes. A user-interface state cannot silently rewrite them.

The liability provision sharpens the need for separation. A registry’s maximum contractual financial exposure may be tiny compared with the dependence of a running network on stable records and continued service. That imbalance does not prove that AFRINIC acted improperly in 2021, nor that anyone suffered loss. It explains why a design that makes mistakes cheap for the classifier and costly for the classified demands unusually strong correction and review. When risk is asymmetric, a fast path to an adverse state is not neutral efficiency.

Renewal and termination therefore have to begin again, outside the display. A competent process would have to identify the party, the governing agreement and version, the precise term, the facts and supporting material, the required notice, the member’s response or cure, the proportionality of any contemplated action, the authorised decision-maker and the route to review or independent adjudication where needed. A dashboard observation might be admitted as one item in that record. It cannot stand in for the record or prove its own significance by having been displayed.

This boundary also answers the strongest benign argument for closer integration. AFRINIC already administers member obligations and contract renewal. Manual checks can be fragmented, slow and inconsistent. A common display could expose a possible discrepancy early, direct it to finance, technical, administrative or legal staff, and give similarly placed members a more consistent opportunity to respond. Joining reliable indicators to case handling might reduce delay rather than create a new power. In an institution with limited resources, refusing any connection between information and workflow could preserve arbitrary, unrecorded handling.

That case is persuasive up to a precise point. Observation may produce notice. It may route work. It may preserve a chronology. It may even supply a bounded evidence bundle to a competent reviewer. What it may not do is convert age, recurrence or apparent certainty into a consequence automatically. The efficiency gain is in organising the question, not answering it by implication. Similar treatment requires common safeguards as well as common indicators.

The difference can be seen by comparing four arrangements. In the first, a visibility-only design, one track shows source, timestamp, governing version, observation, uncertainty, member response, correction and dispute state. A second track remains dormant unless someone begins an RSA process under separate authority. No change of state crosses the gap automatically. This is the most defensible model.

In the second arrangement, the classification becomes self-executing. A flag persists, ages or repeats until it changes renewal or termination status without a fresh decision about authority and evidence. Time and software are then made to perform legal work. The member may face a practical presumption that the screen is right, even if the underlying question was never properly framed. This is the design the staff assessment’s warning properly excludes.

The third arrangement is manual opacity. Nothing useful appears to the member; checks happen in separate inboxes and undocumented exchanges. That avoids visible automation, but it also preserves surprise, uneven treatment and high correction cost. Opacity is not the answer to authority inflation. The answer is better visibility with a strict stop line.

The fourth arrangement allows evidence export. The display creates a bounded packet for a competent, independent reviewer while preserving the last verified operational state. The reviewer can affirm, correct or reject the claim. The result returns to the record as a reviewed outcome, but the screen never becomes the adjudicator. This arrangement treats transparency as an aid to due process rather than a substitute for it.

The practical location of the stop line depends on details that can seem merely technical. Data-source selection determines which parts of a member’s conduct become visible and which remain outside the frame. Versioning determines whether a historical act is compared with the rule then applicable or with a later text. Refresh cadence decides how long stale information can retain institutional force. Labels determine whether a reader sees an observation, an allegation or an apparent verdict. Threshold and reset rules decide how error accumulates or disappears. Each is an interface choice with distributive effects.

Access control is equally important. A private account notice intended for correction has a different impact from a status exposed to broad staff groups or outside counterparties. The more widely a label travels, the harder it becomes to recover from a false positive. A member may correct the originating field while an old classification survives in a staff queue, a diligence note or a renewal preparation file. Privacy by default is therefore not concealment. It limits the audience of an untested claim until its relevance and accuracy have been established.

Member responses need to travel with the observation, not behind it. If a system shows the possible discrepancy prominently but buries the answer, it gives institutional memory to the accusation and amnesia to the defence. Correction history should preserve what changed and why without presenting the original state as an enduring stain. A dispute marker should disable any silent escalation, and recurrence rules should distinguish the return of the same verified problem from a repeated reading of the same stale source.

Staff queues create another quiet transfer of power. An indicator may not formally decide anything, yet it can determine which members receive attention, which renewals are prepared cautiously and which cases acquire an aura of seriousness. Prioritisation is not adjudication, but it shapes the environment in which adjudication occurs. A defensible queue should therefore expose why the item is present, how current the underlying information is, whether the member has answered and whether a human has verified that the named source actually applies.

The final interface—the bridge from an indicator to an RSA process—is the crucial one. It should require an affirmative, recorded act by an authorised person. That person should not merely click “escalate”; they should identify the independent basis for opening the contractual inquiry. The consequential file should carry its own evidence and notices rather than inheriting the dashboard’s classification as a settled premise. If the dashboard is later corrected, the separate process should be forced to confront the correction. No status should become more authoritative merely because it was copied into another system.

These safeguards address operational harm without claiming an outcome that the 2021 record does not prove. An unexplained flag can cause support work, delay and uncertainty. It may affect internal renewal preparation or lead a counterparty to ask questions during diligence. It can make an operator reserve time and money for continuity planning. False positives and stale sources can impose correction costs even when no formal step follows. Compressed labels can also erase the difference between a data mismatch, a contractual allegation, a policy question and a public-law finding.

The wider economic risk lies in anticipation. Networks and their investors do not wait for final failure before responding to uncertainty. They ask whether a dependency is stable, whether a record can be corrected quickly, and whether a contested classification can affect continued service. A poorly bounded indicator can therefore add financing, transaction and planning contingencies before any proven termination. The record supplies no quantified loss, false-positive rate, correction time, implementation cost or affected-resource count. The mechanism is credible; the magnitude in this episode is unknown.

LARUS’s relevance follows from this operator perspective. As a first-party commercial and operational continuity provider, it describes how direct holders carry exposure to registry policy, audit, renewal, revocation and institutional failure, and how those risks translate into planning and business decisions. That experience does not prove what AFRINIC did with Draft 2. It helps explain why registry-layer uncertainty has costs even when a proposal remains only a proposal, and why continuity cannot depend on an institution reviewing its own classification at its own pace.

NRS approaches the same problem through rights-protecting design. Exit, portability, redundancy and mechanism-first decentralisation give an operator options when a central coordination point fails or overreaches. NRS is not AFRINIC, an arbitrator or the contractual decision-maker. Its contribution is to insist that rights need technical and institutional means of preservation, not only assurances of restraint. A correction channel is better when the disputed operational state is protected while correction occurs; review is more meaningful when a member has a viable alternative to submission.

BTW’s role is different again. It is an editorial reality layer: its task is to keep official act, private claim, contractual question, inference and uncertainty separate in public understanding. The AFRINIC page proves publication of Draft 2 and the staff assessment. The RSA proves what that separate instrument describes. Heng Lu’s work supplies the governing analysis of thin coordination and authority inflation. NRS and LARUS explain rights-protection and continuity mechanisms from their own positions. None may be substituted for another, and none turns commentary into proof of an unrecorded 2021 outcome.

This separation of source roles is not academic housekeeping. The dashboard problem itself arises when unlike categories are compressed. “Non-compliant” may sound conclusive while leaving unanswered the most important questions: non-compliant with what, according to whom, on which evidence, under which version, with what consequence and subject to what remedy? A technical observation, a contractual claim, a corporate decision and a public-law judgment do not become interchangeable because one adjective can describe all four. The display must reveal those differences rather than erase them.

There is also a temptation to treat repetition as proof. A status that appears every morning may look more certain each day, although the system may simply be rereading the same datum under the same assumption. Recurrence can matter only if it represents a genuinely new observation under a valid rule. Otherwise it is the multiplication of one claim, not independent corroboration. Board attention, staff circulation and the formal appearance of MyAFRINIC similarly amplify visibility but do not add legal authority.

The watchpoints are therefore concrete. Does the card name the source and its age? Does it state which rule or agreement version is being invoked? Can the member see the raw fact or an intelligible account of it? Is uncertainty expressed, or hidden behind a categorical label? Does an answer remain attached wherever the status travels? Can a false positive be corrected without leaving the accusation active elsewhere? Does a dispute freeze automation? Is the last verified operational state protected while review continues? Most importantly, can anyone trace a renewal or termination step to authority and evidence independent of the dashboard?

These questions preserve the registry’s legitimate information function. A blank screen would not protect members if opaque files still shaped decisions. Better observability can reduce stale records, surprise and inconsistent administration. It can let a member correct an address, explain an anomaly or direct a specialist to a precise point. Institutional modesty is achieved not by knowing less, but by refusing to confuse a better-organised observation with a greater right to decide.

The most important contribution of the Draft 2 staff assessment was thus a rule of institutional architecture. Visibility belongs in the account interface. Renewal and termination belong to their governing agreement and a separately authorised sequence. The air gap between them must be real enough to resist administrative habit, not merely drawn in a diagram. Once a display becomes the reason a contract changes state, the distinction has already failed.