Summary

  • ARIN’s 29 September guidance says ARIN Online automatically links a new POC to the account of the user who creates it. A person-type POC can have only one ARIN Online account linked at a time, so the intended colleague cannot link an account to a person POC created for them by someone else.
  • ARIN recommends that each individual create their own person POC, then provide its handle to an authoritative Admin or Tech POC for the organization. A role-type POC may be linked to several accounts when shared management is appropriate.

The consequential choice happens at creation

ARIN’s advice is unusually direct: do not create a person-type Point of Contact (POC) handle for another individual. The reason is not that the record is merely a public name or that the organization cannot list a colleague. It is that creation and account linkage are joined in ARIN Online.

In its September 2026 ARIN Bits, the Registration Services Department says a person POC can have only one ARIN Online account linked at a time. The same guidance says the system automatically links a newly created POC to the account of the user who created it. If that user creates a person POC meant for a colleague, the creator’s account is attached; ARIN says the colleague then has no way to link their own account to that handle. The dated public tip does not describe an independent test or quantify how often this happens. It documents the workflow ARIN is telling customers to follow.

That detail matters because a POC record and an ARIN Online account perform different jobs. ARIN describes POCs as person- or role-based contact records, with information such as a name, email, postal address and phone number. A POC may be listed for functions including Admin, Tech, Abuse or network operations. The account is the user’s authenticated identity in ARIN Online. A contact field should not be read as proof that the named person controls the linked account, and an account link should not be mistaken for an organization’s authorization decision.

The new authenticated, ticket-based linking process makes the distinction more consequential. ARIN introduced it to handle requests to link users to existing POCs; its January explanation describes approvals inside ARIN Online, rather than the earlier email-based process. But a person-type record has a one-account limit. A colleague cannot solve a creator-linked mismatch simply by entering the ordinary request-and-approval path described for existing POCs.

ARIN’s recommended sequence separates identity from organizational association. Each person creates their own person POC and gives its handle to an authoritative Admin or Tech POC for the Org ID. ARIN’s guide says an existing organization POC may need to associate the new POC with the Org ID. When a shared function needs several linked users, ARIN says a role-type POC may be more practical, where appropriate.

This is a bounded workflow constraint, not evidence of an account takeover, data exposure, customer lockout or broken recovery process. The public guidance reviewed here does not say what correction route applies if someone has already made a person POC for a colleague, nor does it establish how common the mismatch is. It does show that the creator’s account is not a neutral placeholder: it becomes the linked identity by default.

The useful interface safeguard would be small and explicit: before submission, show which ARIN Online account will be linked, distinguish a person record from a shared role contact, and make the consequence clear. That would put the decision where ARIN says it occurs—at creation—without turning a contact record into a proxy for organizational authority.

Sources