Summary

  • AFRINIC's mirrored AfPIF service page advertised 30-minute consultations for BPKI and 2FA checks, WHOIS and registry corrections, Designated Representative work, RPKI and open tickets during the 17–20 August forum in Kigali.
  • Face-to-face proof can establish that a person matches presented evidence. It does not by itself establish which organisation the person may bind, which act was authorised, whether staff approved it, or what the back end finally stored.
  • Each completed or deferred case should leave a protected handoff receipt linking the person, role, requested act, decision, before and after state, notification and correction route. Public reporting can remain aggregated and disclose no identity document.

The venue became an input channel

The AfPIF organisers placed the 2026 forum at the Kigali Marriott Hotel from 17 to 20 August. AFRINIC used that gathering for something more operational than a presentation. Its event page offered scheduled, emailed and walk-in sessions, normally 30 minutes long, and a remote alternative for people who could not attend.

The service menu was broad. Members could ask about RPKI and ROAs, bring WHOIS and registry records into line, plan IPv6 work, confirm a Designated Representative, explore membership or advance an open ticket. The page said engineers would work with people on their own resources while the staff had direct access to the registry back end.

For BPKI and 2FA, AFRINIC described face-to-face identity checks that might replace several days of correspondence. It asked a prepared attendee to bring an organisation handle, the registered email address, a government-issued ID where relevant, representative details, ticket numbers and a note of records believed to be inaccurate. The promised outcome was similarly concrete: records aligned to reality, eligible verifications completed and a clear next step for anything not finished on the day.

That is useful member service. Physical presence can remove ambiguity that persists through an email chain. It can also compress several stages into one conversation so tightly that the stages become hard to see.

One meeting contains four different statements

The first statement is about the human: the person present matches the identity evidence. The second is about role: that person may act for a particular organisation in a particular capacity. The third is about authority: the role permits this exact request under the applicable rule. The fourth is about state: authorised staff made, declined or deferred a defined change in an account or registry system.

None of those statements automatically proves the next. A passport can be genuine while the bearer has no authority to replace an organisation's contact. A Designated Representative may have one institutional function without being entitled to alter every resource object. A correct approval can still await another dependency. A staff action can finish in an internal account while a public WHOIS object remains unchanged for a legitimate reason.

This separation matters precisely because AFRINIC advertised a direct route from the venue to staff with back-end access. The attendee should never be treated as having that access. The conference desk is a front end; the authoritative state remains the controlled account and registry workflow behind it.

Identity proofing is not the same as organisational authority

NIST SP 800-63A offers a useful external benchmark, not a law for AFRINIC. It separates identity resolution, evidence validation and identity verification before an authenticator is bound to an account. Its account guidance also recognises that one human may act personally in one setting and as a business representative in another.

That distinction fits a registry unusually well. An individual can be a portal user, billing contact, technical contact, corporate officer, Designated Representative or outside adviser. One identity may carry several roles; one role may authorize only certain acts. The record must preserve both the verified person and the asserted capacity without treating them as interchangeable.

The NIST subscriber-account guidance also requires records of proofing steps, evidence types and issuers, and the validation and verification methods used. For account changes, it calls for validation of core-attribute updates, notification to the subscriber and a channel to report unauthorised access or suspected compromise. AFRINIC can adopt the logic without importing the American framework wholesale.

A useful receipt protects evidence instead of publishing it

The member-facing record could be compact. It should identify a case or ticket, organisation handle, affected object class and the requester's role. It should record the evidence class and issuing source—not a public scan—together with the verification method, time and responsible staff role. It should then name the precise requested act, applicable authority, protected before-state fingerprint, approval, back-end write status, after-state reference, notification result and any unresolved dependency.

The last fields are as important as the first: correction route, compromise-reporting channel, rollback status where reversal is possible, and the retention or deletion class for personal evidence. A deferred case should receive a receipt too. Not completed is useful only when the pending fact, owner and next step are named.

Public accountability needs much less detail. AFRINIC could publish aggregate counts by service class: consultations held, proofing completed, changes completed, matters deferred and notifications delivered. It could disclose the receipt schema and exception categories without exposing a member, resource, ticket or identity document.

No reviewed source establishes that anyone used the service, that any write occurred or that AFRINIC lacks internal logs. The event page is a promise, not an outcome ledger. The receipt proposed here is therefore a prospective control, not a finding of failure.

Accuracy is the narrow reason for the workflow

Heng Lu's Bill of Rights of Uniqueness Coordination says registry records should reflect operational, legal and market reality while the common layer remains thin: uniqueness, proof of control, accuracy, security assertions, transfer records, auditability and replacement paths.

The Kigali service can be read in that narrow frame. Bringing an obsolete contact into line or binding a legitimate authenticator to the right account is registry maintenance, not governance over an operator's business. The receipt keeps that boundary visible. It shows which fact was verified and which registry act followed; it does not grant the registry a general power to investigate everything about the member.

AFRINIC made the conference a practical input channel. The durable authority should still come from a controlled decision and an inspectable state transition. Give the member a private receipt, publish only aggregated process evidence, and keep the person, role, act and result distinguishable after Kigali.

Sources

  • Independently hosted text mirror of AFRINIC's AfPIF 2026 service page
  • AfPIF, event site for the 2026 Kigali forum
  • NIST, Digital Identity Guidelines: Enrollment and Identity Proofing and Subscriber Accounts
  • Heng Lu, The Bill of Rights of Uniqueness Coordination