Summary

  • Draft 1 of the Clarification on IPv6 Sub-Assignments correctly recognised that temporarily giving a third-party device an address or /64 on a link operated by the original receiver need not amount to an independent downstream assignment.
  • The proposal nevertheless retained a categorical exclusion for permanent connectivity and broadband service, using duration and a commercial description as substitutes for the more important facts of holder control, contactability and operational independence.
  • AFRINIC-28 recorded questions, misunderstanding and unresolved wording, then returned the draft to the mailing list as “More discussion needed”; the evidence does not establish consensus, ratification, implementation or an enforcement action.
  • A legitimate registry rule should follow objective changes in the state of the ledger—uniqueness, control, contacts, security information and disputes—without granting a private coordinator authority to licence network architecture or customer relationships.

L3 — The /64 that looked like a transfer but was not

The easiest way to understand the problem is to begin at the access point rather than in a policy manual. A company operates an IPv6 network for its own premises. Its router advertises connectivity; its staff control the switching, wireless configuration, filtering and upstream relationship. A guest arrives for a meeting. The guest’s telephone joins the wireless network and receives IPv6 addressing for the length of the visit. Nothing about that event makes the guest the operator of an independent network.

The guest cannot change the organisation’s registry contact, originate the organisation’s route at will, administer the access point or decide where the prefix will be used tomorrow. A packet crosses a device boundary, but operational control of the relevant link remains where it was.

Blanket language about addresses being used by a third party can miss that distinction. If the only question is whether someone other than the original receiver’s employee or equipment has touched an address, a guest session begins to resemble a forbidden sub-assignment. The same problem appears when an employee brings a personal device, when a hotspot gives clients isolated IPv6 service, when a virtual private network gives an endpoint an address, or when an operator numbers a point-to-point link. In each case, the address is used beyond a narrowly imagined boundary around the original recipient.

In none of those cases does that fact alone establish that control of an independently operated network has passed downstream.

That was the concrete defect addressed by the first draft of the Clarification on IPv6 Sub-Assignments. The instrument must be identified precisely. It was AFPUB-2018-V6-002-DRAFT01. The similar identifier AFPUB-2018-V6-001-DRAFT01 belongs to a different proposal, the IPv6 Policy and References Update. The difference is not clerical trivia. Policy histories are made from identifiers, dates and revisions; confusing two instruments can attribute text, discussion or status to the wrong institutional act. Here, the authoritative proposal page fixes the sub-assignment clarification as V6-002, Draft 1.

Its date also needs two entries rather than one deceptively tidy birthday. The details panel records that the proposal was submitted on 14 March 2018. The revision history records the initial draft as posted to the rpd mailing list on 20 March 2018. Submission metadata and public posting history describe different steps. Neither should be silently replaced by the other. The exact act examined here is the publication and discussion of Draft 1, with the later March date marking the initial-post entry and the earlier one preserving the official submission field.

Draft 1 sought to amend the assignment language in section 6.8 of the Consolidated Policy Manual. Its stated problem was practical: existing wording had not properly accommodated point-to-point links, virtual private networks, hotspots, guests, employees, bring-your-own-device arrangements, or the practice of giving a unique /64 to an interface or host. Those examples share no single commercial form. What connects them is a topological possibility. IPv6 permits an operator to place a distinct address or prefix at an edge without surrendering control of the network that supplies it.

The unit in the proposed exception mattered. Draft 1 referred to one address or one /64 provided to a third party. It did not present the third party with the holder’s much larger IPv6 allocation, nor did it describe the transaction as conveying ownership. A /64 sounds enormous when expressed as a count of individual addresses, because IPv6’s numerical scale is enormous. Operationally, however, a /64 is the conventional subnet boundary implicated in host and interface design. The policy question cannot therefore be answered by reacting to the raw size of its address count.

The material question is what the recipient can control, and what the holder still operates.

The draft’s proposed test combined three elements. First, the use involved a third party. Secondly, it concerned an address or a /64. Thirdly, the use was non-permanent and occurred on a link operated by the original receiver. When those conditions were met, the arrangement would not count as a sub-assignment. The test was designed to protect a narrow but important space: temporary address use inside an operational environment that remained under the original holder’s command.

Each element did work. “Third party” acknowledged that a guest or other external device really was involved rather than pretending all users were internal. “Non-permanent” tried to distinguish a passing session from a durable downstream service. “Link operated by the original receiver” anchored the exception in control of the infrastructure. The address-or-/64 limit kept the proposal focused on an edge use rather than an onward disposal of the received resource.

Taken together, the elements explained why a hotel guest, visiting contractor or employee’s personal handset could use IPv6 without the registry pretending a new provider-independent holder had appeared.

The operational examples supplied texture. Guest access is transient and remains governed by the venue’s network. Employee use may involve equipment owned by a person rather than by the address holder, yet the employer still operates the local link. A device or server can receive a distinct /64 as part of host isolation or addressing design without acquiring authority over the provider’s aggregate. A hotspot serves multiple third-party devices while its operator retains the radio, router and uplink. A VPN creates a logical endpoint whose address may appear remote even though the original organisation administers the tunnel and address plan.

Point-to-point links put addresses at two ends because the link requires endpoints, not because each endpoint has become an independent registry principal.

The technical context made the concern more than hypothetical design theory. RFC 8273, published in December 2017 as an informational document, described a unique IPv6 prefix per host on provider-managed shared-access networks. The approach could assist host isolation and subscriber management, while also creating a privacy trade-off if a stable prefix became associated with a subscriber. That account demonstrates a real deployment pattern in which a unique prefix at a host does not necessarily mean the provider has relinquished its network. It does not, however, decide AFRINIC policy, and it is not a Standards Track mandate.

A technical design can show that a definition produces false positives; it cannot confer authority on a registry.

Draft 1 did not remove every restriction. Permanent connectivity and broadband service remained treated as prohibited sub-assignment. That exclusion placed a durable customer relationship on the other side of the line even if other facts might still show that the original receiver retained significant operational control. Duration became a proxy for institutional independence; “broadband” became a proxy for an assignment class. Those proxies may often point towards a real downstream control change, but they are not themselves proof of one.

Point-to-point addressing received an additional qualification. The draft allowed that the addressing on a point-to-point link could be permanent, but said it could not be used directly or indirectly for the actual communication behind the link. The distinction attempted to separate numbering required to make a link operate from addresses delivered through that link for the downstream party’s substantive network activity. A router interface could remain numbered; the exception was not meant to become a route for supplying general permanent service behind it.

That qualification reveals both the proposal’s care and its strain. It was sensible to distinguish the mechanics of a link from an independent network reached over the link. Yet “actual communication” could be difficult to apply in a world where link addressing, routing, tunnelling and service functions overlap. An operator reading the phrase would need to decide which packets counted as use “for” communication and which merely sustained the link.

The words tried to police function through a categorical boundary when a control-and-record test might have asked the more tractable question: has an independently accountable network gained durable authority over the relevant prefix?

The public meeting at AFRINIC-28 on 9 May 2018 exposed that unresolved point. The official minutes record the presentation and discussion of cases involving point-to-point links, VPNs and hotspots. AFRINIC staff asked whether the temporary uses would need to be registered in WHOIS. The author’s answer was that these uses were temporary and did not need registration. That answer belongs to the particular examples under discussion. It should not be inflated into a universal proposition that third-party use never affects records, or that duration automatically exhausts every recordkeeping question.

WHOIS was a revealing question because it translated the semantic dispute into registry work. If a visitor’s handset receives a /64 for an afternoon, a new public record would add little accountability. The record could be obsolete before it was reviewed, while the holder already remained the responsible operator of the link. If, by contrast, another organisation takes durable control of a prefix, operates its own infrastructure and becomes the meaningful abuse or security contact, leaving every record pointed solely at the original receiver could obscure operational reality.

The same word, “sub-assignment”, was being asked to distinguish those two states.

The meeting did not settle the distinction. The minutes record positive feedback, misunderstanding and textual comments that remained unresolved. The co-chairs’ disposition was “More discussion needed”, with the proposal returned to the mailing list for refinement. That procedural outcome is central. Draft 1 was a proposal under discussion, not an enacted public law and not even a demonstrated final community rule. The available evidence establishes publication, presentation, questions and a no-consensus return to discussion.

It does not establish ratification, implementation, application to a particular member, denial of a resource, service interruption or enforcement action.

Later history cannot be used to rewrite that moment. The existence of a later Draft 2 and later manual language shows only that the proposal family continued and that implementation history belongs to a different stage. It cannot be backdated into Draft 1. Nor should this inquiry drift into the separate IPv6 PI eligibility proposal, general arguments about contracts, current institutional disputes or IPv6 economics. The event at issue is narrower: Draft 1 tried to rescue temporary on-link third-party use from an overbroad prohibition, retained a permanent-service exclusion, and returned from AFRINIC-28 without consensus.

Within that narrow frame, Draft 1 achieved something valuable. It made visible the difference between an address appearing on somebody else’s device and control of number-resource space moving to somebody else’s network. That is the first distinction any sound registry rule must preserve. But the proposed words did not yet carry the analysis far enough. By relying on temporary use and excluding permanent connectivity or broadband as categories, they left open whether the registry was recording an operational fact or granting permission for a relationship.