Summary

  • draft-eggert-procon-chair-standin-00, posted on 29 June 2026, would have the IETF Chair designate another Area Director as an emergency stand-in. If the Chair becomes incapacitated, that person would “automatically and immediately” assume the Chair role.
  • The proposal fills a real timing gap. RFC 8713 can allow up to six weeks for a reconvened NomCom to fill a mid-term vacancy, and that process installs a replacement. It does not provide an immediate, temporary bridge for partial or full incapacity.
  • The draft identifies the successor but does not identify who determines that incapacity has begun, what record activates the transfer, how partial incapacity changes scope, what happens when the two officeholders disagree, or who acts if the stand-in is also unavailable.
  • A workable rule should publish the institutional state, not a person's diagnosis: who designated and accepted the standby role, which authorized body activated it, when authority moved, what emergency scope applied, and when authority returned or ended.

A switch without a sensor

The proposed handover is easy to read because its central sentence is short. The IETF Chair, at their sole discretion, chooses another Area Director as stand-in when taking office and may change that choice later. If the Chair becomes incapacitated, the stand-in assumes the role automatically and immediately. The delegation ends when NomCom appoints a new Chair or when the incumbent declares themself fit for duty again.

Each component answers a different question.

  • Designation answers who is prepared.
  • Activation answers who is acting now.
  • Termination answers when the temporary authority stops.

The draft gives the incumbent control over the first act and a unilateral route through one branch of the third. It leaves the second act without an institutional actor.

Calling the handover automatic does not remove that missing actor. Institutions do not observe incapacity as a Boolean value supplied by nature. Someone receives incomplete facts, decides that a threshold has been met, communicates the decision and causes other bodies to recognize the stand-in. Even a software switch needs an input. Without a named sensor, “automatic” can mean whatever the first person to act says it means.

That ambiguity is not an argument against having a stand-in. A pre-designated successor is far better than improvising a name during a crisis. It lets the person consider the duty in advance, lets colleagues prepare access and communications, and reduces the risk that a temporary continuity decision turns into an unplanned leadership election. The problem is narrower: identity alone cannot authorize activation.

A genuine gap, and a careful status boundary

The draft's diagnosis of the timing problem is sound. RFC 8713 addresses a mid-term vacancy through NomCom selection and confirmation. If the committee must reconvene, completion is due within six weeks. The successful candidate then serves the remainder of the open term, or the remainder plus another term in specified circumstances. That is a permanent-replacement mechanism. It is intentionally deliberative and cannot be the only answer to a Chair who is suddenly unable to act for a day, a week or an uncertain period.

Recall is not an emergency bridge either. RFC 8713 requires a petition, a recall committee, investigation and a three-quarters majority among those voting. If recall succeeds, the position is filled under the mid-term vacancy rules. Those safeguards make sense for removal. They are poorly shaped for restoring an operational decision path in the next hour.

The gap does not make the current draft law. On 28 August 2026, the Datatracker described revision 00 as an active individual Internet-Draft, dated 29 June and expiring on 31 December. It had no RFC stream, responsible Area Director or telechat date. The PROCON page listed it among related documents, not the Working Group's active Internet-Drafts. The usual Datatracker warning therefore matters: anyone may submit an individual I-D; it is not IETF endorsement and has no formal standing in the standards process.

There is evidence of interest. At the IETF 126 PROCON session, a poll asked whether the group should adopt both Chair documents. The machine record shows 12 yes, one no and one no opinion, with 30 people present at the close. The minutes then list a formal mailing-list adoption call as a next step. The clean description is that a room poll supported taking up the work. It is not that the stand-in rule was adopted, approved or put into force.

The meeting had already found the missing question

The activation problem is not an external objection invented after publication. It appears in the IETF's own discussion record.

At IETF 125, the PROCON minutes record Jari Arkko arguing that the group should not try to define incapacity itself, but should define who can decide. That distinction is exactly right. A process document should not attempt to write a universal medical definition. It should assign decision authority and specify the minimum procedural threshold for changing the institution's state.

The same session's public chat sharpened the conflict. Eric Rescorla asked whether incapacity could be involuntary and wondered whether emergency powers could be limited. Joel Halpern observed that the then-current text appeared not to allow involuntary incapacity because the Chair could reclaim the role by speaking up. Mike Bishop asked for a tie-break if the Chair said they were not incapacitated and the successor disagreed. These were individual interventions, not consensus. They nevertheless prove that the blank space was visible before the emergency text became its own draft.

The record also shows that the successor's identity was not self-evident. Earlier presentation material placed the IAB Chair first and the IETF LLC Chair behind them. Later text moved to an Area Director selected by the incumbent. At IETF 124, participants debated whether one person could stand in for every attached role or whether different roles needed different answers. The design evolved from an office-based chain to a named-person model. That history strengthens the case for a public designation record and an alternate, not for pretending that one arrangement was always inevitable.

Partial incapacity is a scope problem

The draft's introduction refers to a Chair who is partially or fully unable to serve. Its operative paragraph then says the stand-in assumes “the role of the IETF Chair.” Those two formulations do not quite meet.

Full inability suggests a broad temporary substitution. Partial inability might mean something much narrower: the Chair can perform ordinary business but cannot join a particular confidential matter; can participate asynchronously but not chair a live meeting; can make decisions but cannot sustain a travel schedule; or is temporarily unreachable while other functions continue. The sources report no actual case, and the policy should not build itself around speculative diagnoses. The structural point is that partial inability has dimensions, not merely degrees.

If every limited conflict or short absence transfers the entire role, the emergency mechanism becomes disproportionate. If nothing transfers until the Chair is completely unable to communicate, the bridge activates too late. The rule therefore needs either named scope classes or a bounded activation instrument that says which functions move. It also needs a default: urgent continuity acts may move while decisions that can safely wait remain with the office or pause.

This is where the adjacent delegation draft must stay separate. A capable Chair voluntarily distributing work is exercising office. An emergency body activating a stand-in because the Chair cannot exercise office is changing who holds operative authority. The first begins with a live principal. The second exists precisely because the principal may not be able to speak. The same Area Director could receive both assignments, but the authority chain is different.

Return is another trigger, not an undo button

The current text makes one return path clear: the emergency delegation ends when the Chair declares themself fit for duty again. That protects the incumbent from a stand-in who might otherwise prolong temporary power. It also creates a hard case the text does not address. What if the declaration is disputed by the stand-in or by the colleagues who activated the emergency state?

Silencing the incumbent would be a serious act and cannot be left to the successor's preference. Treating any message as conclusive could be equally unstable when the original incapacity involved judgment, coercion or compromised communications. The policy does not need to decide that conflict in public. It does need a tie-break authority, an expedited review path and a rule for what happens while the conflict is resolved.

NomCom appointment provides the other termination path. That is not a return; it is the end of temporary continuity because a new officeholder has been selected. The record should preserve those outcomes separately. Returned to incumbent and terminated on replacement have different authority histories and different implications for unfinished acts.

The same separation matters if the designated stand-in cannot act. A second incapacity, conflict of interest, resignation or communications failure must not send the institution back to improvisation. A backup sequence, or a body authorized to name an alternate for the emergency only, is part of the continuity design.

Publish authority state, not health evidence

A demand for accountability can become invasive if it asks the public to judge a person's medical condition. That is unnecessary. Readers need to know why a different person is exercising institutional authority. They do not need symptoms, diagnoses, family communications or confidential safety assessments.

The public fact can be thin: the designated deciding body found the activation condition satisfied under a named rule at a given time; the stand-in accepted; specified authority moved; the next review occurs by a stated deadline. Supporting evidence can stay with a small authorized group under confidentiality. A later audit can test whether the group had the required members and followed the decision rule without publishing the evidence itself.

This distinction is more than privacy etiquette. It prevents the stand-in mechanism from becoming a forum for public speculation about a leader's fitness. It also prevents privacy from becoming an excuse for an invisible power transfer. Health evidence is private. The institution's authority state is public.

Brian Carpenter's response to the new draft captured one part of that difference in three words. He proposed that the Chair “designates and announces” the stand-in. Announcement would let the community know the standby identity before a crisis. It would not by itself activate the person. The public record needs both events and must never merge them.

Four receipts for one temporary bridge

The smallest auditable design is not a medical code. It is a set of four institutional receipts.

The designation receipt

It names the stand-in, the designating Chair, the effective date, the stand-in's acceptance, any backup and the public notice location. It proves preparedness, not present authority. A later change should append a new receipt rather than silently overwriting the old name.

The activation receipt

It identifies the decision body, the rule and quorum used, the timestamp, the stand-in's acceptance and the scope class. It can state that confidential supporting evidence was reviewed without describing it. If exceptional unilateral activation is allowed because the deciding body cannot assemble, the exception should expire quickly unless ratified.

The acting receipt

It binds consequential decisions to the emergency authority window. It need not create a new bureaucracy or log every email. It should make it possible to distinguish acts taken as ordinary Area Director, acts taken under voluntary delegation and acts taken as temporary Chair. Conflicts and recusals should travel with the relevant act.

The return receipt

It states whether authority returned to the incumbent or ended on a new appointment, the effective time, the resolving authority if there was a dispute, and the disposition of pending matters. It closes the temporary chain without erasing it.

Together these records answer the questions that “automatic” currently compresses: who was ready, who decided, what moved, what occurred and how the bridge ended. They also put liability beside power. A person or body that can switch the IETF into an emergency authority state should be identifiable, bounded and reviewable.

What the draft can become

The stand-in proposal begins from restraint. It does not create a permanent deputy, stage a snap election or let a temporary absence consume a six-week selection process. It prepositions one serving Area Director and ends the bridge when ordinary authority returns or NomCom installs a replacement. Those are useful properties.

Its next revision should preserve that thinness while finishing the state machine. Name the incapacity decider. Define a fast quorum and an alternate. Separate partial from full activation. Require advance announcement and timestamped activation. Bound emergency powers. Create an expedited disagreement review. Record return and replacement as different endings.

That would not turn the IETF into a medical tribunal. It would do the opposite. It would keep private evidence private while refusing to make institutional power invisible. The successor circuit is already drawn. The work now is to install the sensor and label who is authorized to read it.

Sources