Summary

  • The proposed division is functional, not hierarchical. The IGF discovers, frames, compares and publishes public problems. NRS authenticates adopted service relationships, maintains narrow number records, executes corrections and portability, and supplies notice, reasons, review and continuity to operators using it.
  • A forum outcome is not an instruction to NRS. An NRS response is not proof that the forum endorsed NRS. Each handoff needs a public issue statement, named recipient, evidence boundary, requested act, receipt, jurisdiction decision, response and later status.
  • Operators remain principals for their own networks. NRS cannot route traffic or borrow operator authority from membership; the IGF cannot convert attendance into consent. Governments, courts and standards bodies retain their separate legal, adjudicative and technical functions.
  • The central safeguard is an adoption firewall. No recommendation enters NRS's common rules or operator contracts automatically. A consequential change needs an identified authority, exact instrument, implementation evidence, transition path, refusal path and remedy.
  • Success should be measured separately: the IGF by traceable handoffs, recipient responses, correction and learning; NRS by accuracy, response time, portability, service continuity, reasoned decisions, successful review and tested institutional replaceability.

The future is not a contest for the larger institutional noun

Internet governance debates often begin by asking which institution should become more powerful. That starting point produces predictable bids. A forum seeks more consequential outcomes. A technical body presents expertise as jurisdiction. A registry describes operational dependence as stewardship. Governments translate public responsibility into claims over a global coordination layer. The result is a contest over institutional nouns rather than a design for specific acts.

The NRS-IGF relationship should begin elsewhere. What act is required? Who has the relevant lever? What authorizes that actor? Which evidence must be considered? What public record should remain? How can an affected operator challenge an error without interrupting uniqueness?

Those questions permit two institutions to be important at the same time. The IGF can be the place where a small operator, government ministry, engineer, researcher and rights advocate compare a registry failure that none could fully see alone. NRS can be the place where an adopted service contract turns a verified request into a corrected record, a portable export or a stayed adverse action. One institution expands the field of knowledge. The other performs bounded acts.

Neither needs the other's title. The IGF need not become a global regulator to matter. NRS need not call itself the voice of the Internet to execute useful rights. Complementarity begins when each institution refuses the prestige of pretending to be the whole system.

Discussion and execution are defined by verbs

The cleanest boundary is grammatical. Discussion verbs include convene, hear, compare, question, document, recommend, translate, publish and follow up. Execution verbs include authenticate, register, correct, export, import, stay, restore, decide and remedy. The same subject may pass through both layers, but the verbs do not become interchangeable.

The Tunis Agenda gave the IGF an unusually explicit set of discussion verbs. Paragraph 72 tells it to discuss public-policy issues, facilitate discourse, exchange information, identify emerging issues, make recommendations where appropriate, build capacity and publish proceedings. Paragraph 77 then says the forum has no oversight function, does not replace existing institutions, is non-binding and has no role in day-to-day or technical Internet operations.

The NRS Charter takes the opposite functional starting point. It describes accurate number registration as the narrow duty of a registry and presents the recordkeeper as a bookkeeper rather than a transnational regulator. That premise supports executable verbs, but only inside the adopted relationship that authorizes them.

The distinction is not between talking and doing in the dismissive sense. Publishing a well-evidenced problem can change what governments, companies and technical institutions later do. Correcting a record can be mundane and still have serious consequences. The boundary identifies how influence becomes an authorized act.

The IGF's permanent status increases the value of a handoff

The General Assembly's Resolution 80/173 made the IGF a permanent UN forum in December 2025. It continued the UN DESA-hosted secretariat, called for stable staffing and sustainable resources, strengthened intersessional work and asked for annual reporting and transmission of outcomes into relevant UN processes. It also continued to describe the IGF as a platform for discussion and dialogue.

That settlement makes a cross-layer interface more plausible. A temporary conference can raise an issue and then lose the record, the relationships or the staff needed to ask what happened. A permanent forum can maintain a public docket across annual meetings, national and regional initiatives, dynamic coalitions, policy networks and best-practice work. It can return to an unanswered recipient. It can compare an institution's explanation in one year with its conduct in the next.

Permanence therefore increases the value of the IGF as a sender and monitor. It does not turn the sender into the recipient. Paragraph 100 asks relevant UN entities to take IGF outcomes into account; it does not direct a registry to execute them. Paragraph 102 strengthens inclusive dialogue; it does not create a number-service credential.

The right institutional response is not to minimize the resolution. It is to use the continuity it provides for disciplined follow-up while preserving the authority boundary its operative text leaves intact.

NRS must distinguish current identity from future capability

The Number Resource Society currently presents itself publicly as a membership and advocacy institution concerned with number-resource rights, business continuity, accurate registration and reform. Its charter and other public materials establish direction. They do not by themselves demonstrate a globally recognized production registry, provider-portability system or independent adjudicative service.

That distinction is essential to a positive account of NRS. An institution gains trust by naming what it can execute now, what it is testing, what depends on counterparties and what remains a proposal. Advocacy can organize operators and clarify rights. A prototype can test data portability. A limited service can prove authentication and correction for consenting parties. Broad execution requires adoption, interoperable systems, counterparties, continuity arrangements and evidence from operation.

The future architecture described here is conditional. NRS belongs at the execution layer only to the extent that it can perform the promised act under an adopted contract and a technically credible service arrangement. If it can receive an IGF referral but cannot alter the relevant record, it should answer as an advocate or researcher, not as an executor. If it can operate a portable registry service for a defined set of users, it should state that scope without implying universal authority.

Honest capability labels prevent the first form of impersonation: presenting an institutional aspiration as an already effective lever.

Thin registration is a demanding service, not an empty database

Thin registration means limited purpose, not low quality. RFC 7020 identifies uniqueness and registration accuracy as core requirements of the Internet Numbers Registry System. It also locates route announcement and the manner of advertisement outside the registry's scope. A future NRS service can take that division seriously while improving what happens inside the recordkeeping boundary.

The minimum surface includes a stable identifier for the resource, the recognized holder or authorized controller, provenance for each state transition, validated contacts, proof-of-control references, time, status, dispute metadata and the information needed to prevent conflicting registration. It needs authenticated update channels, historical reconstruction, error correction, export, import, recovery and a way to prove that one provider stopped serving the record before another assumed responsibility.

Publication must be field-sensitive. Operational and due-diligence users need enough data to test uniqueness, contact the responsible party and understand status. Personal data, protected evidence and security material need bounded access. An audit trail can prove that a decision used identified evidence without publishing every underlying document.

Thinness excludes general judgments about an operator's politics, business model, customer geography, financing or speech unless law or a narrowly adopted technical invariant makes the fact necessary to the requested act. It concentrates institutional competence where accuracy can be measured and where a provider can be replaced.

Rights execution is the reason NRS is more than another mirror

A mirrored dataset can improve resilience, but a mirror cannot alone protect an operator facing an adverse decision. The positive case for NRS is that it can combine a narrow technical record with a human-readable rights schedule. The Bill of Rights of Uniqueness Coordination provides the normative direction: uniqueness, accurate records, notice, reasons, evidence, correction, continuity, portability, appeal and replaceability.

Those rights require executable duties. Notice must identify the proposed act, ground, evidence category, responsible decision-maker and deadline. Reasons must connect the evidence to a defined rule. Correction must produce a changed record and a traceable receipt. A stay must preserve the existing state during timely review unless a bounded emergency condition justifies temporary action. Portability must produce an export another qualified provider can verify and import without creating duplicate authority.

Independent review cannot be a second reading by the original official under a different label. The reviewer needs institutional distance, access to the record, power to correct the decision and a published standard of review. Remedy should restore state where possible and address direct service failure under a disclosed liability schedule.

The rights layer is thicker than a database but thinner than general government. It governs the provider's treatment of an adopted operator relationship. It does not grant NRS jurisdiction over everyone who uses the Internet.

Operators are principals, not a stakeholder category to be counted

The two-layer model fails if operators appear only as one interest group among several. They run autonomous networks, choose interconnection and routing policies, bear customer and continuity obligations, and decide whether to adopt a registration service within the limits of law and technical interoperability. Their authority does not come from an IGF badge or an NRS membership card.

An operator may ask the IGF to surface a systemic problem. It may submit evidence to NRS for a record correction. It may participate in both institutions or neither. None of those facts authorizes another entity to consent on its behalf. A trade association can speak for the members and issues covered by its mandate. An NRS officer can decide only what the institution's contracts and corporate authority place within that office. A forum rapporteur can summarize discussion, not create operator assent.

Operator primacy is also bounded. A network cannot create duplicate globally unique resources by assertion. It cannot demand that a registry publish another person's protected data. It remains subject to contracts, applicable law and the technical consequences of other networks' choices.

The useful principle is not that operators are sovereign. It is that the party expected to implement, fund and bear an operational consequence must be linked to the act by a real authorization path, not by attendance rhetoric.

The interface begins with a public issue record

An informal invitation to "engage with the community" is too vague for a consequential handoff. The IGF should be able to publish a structured issue record whenever a session, intersessional group or national initiative asks an operational institution to respond.

The record should state the observed problem, affected functions, evidence base, uncertainty, submitting entities and material dissent. It should identify the institution believed to hold the relevant lever and the act being requested. It should separate public evidence from protected submissions, name the custodian of restricted material and explain whether consent exists to share it with the recipient. It should set a requested response date without implying compulsory jurisdiction.

The issue record must preserve attribution. "Entities in one session raised" is different from "the IGF decided." A dynamic coalition's paper is not the same as an annual meeting message. A national initiative does not acquire authority from the global brand. Each artifact should show its method, contributors, review and status.

This format makes forum influence more credible because it narrows the claim. A recipient can see what is alleged and who is asking. The public can later see whether the recipient accepted the issue, disputed the facts, identified another responsible body or remained silent. Discussion becomes a traceable input rather than atmospheric pressure.

Receipt is not acceptance and referral is not command

NRS should acknowledge a referral promptly, assign a stable public reference and state what it received. The acknowledgement should not imply that NRS agrees with the facts, accepts the requested remedy or recognizes the submitter as an operator's representative. It proves only receipt.

The next step is a jurisdiction screen. Does the issue concern a record or right that NRS actually serves? Has the affected operator adopted the relevant service? Does NRS control the requested lever? Is another provider, court, public authority, standards body or operator the proper recipient? Is the request asking NRS to exceed its narrow purpose?

There are at least four legitimate answers. NRS may accept the matter for decision. It may accept a limited part and refer the rest. It may decline with reasons and identify the apparent recipient. It may request evidence needed to determine scope. None should be described as obedience or defiance toward the IGF.

A public receipt also protects NRS. It prevents later claims that a broad forum conversation instructed an undocumented action. The institution can show the exact request against which its authority was assessed. The IGF benefits because a declined referral becomes evidence about fragmented responsibility rather than disappearing into private correspondence.

The interface is strongest when both institutions can say no precisely.

An execution response needs evidence of the act

If NRS accepts a matter, its final response should separate finding, authority, act and effect. The finding states what the evidence supports. The authority identifies the adopted contract, service rule, operator instruction, technical invariant or lawful order that permits action. The act names the state change or remedy. The effect records what changed and what remains outside NRS control.

A correction response, for example, should identify the affected record fields, prior and corrected state, effective time, authentication method, notice given, review status and exported update. It should not claim that traffic changed. An operator may continue announcing a route, and other networks may continue treating it according to their policies. RFC 7020 expressly separates registry state from route operation.

A portability response should identify the old and new provider, state snapshot, transition sequence, conflict check, credential consequences, rollback condition and proof that no simultaneous authoritative service was created. A denial should identify missing evidence and the appeal route.

Machine-readable receipts can use open registration-data formats where suitable. RFC 9083 demonstrates how RDAP structures responses, while RFC 9224 addresses bootstrap behavior. Conformance can make receipts portable; it cannot decide the underlying right. That remains the authorized institution's accountable decision.

No recommendation enters the common layer automatically

The adoption firewall is the constitutional center of the design. The IGF may produce an excellent recommendation supported by broad participation and compelling evidence. NRS should still not insert it automatically into its technical rules or operator contracts.

Minimum Initial Specification, Localized Future Decision, and Voluntary Adoption argues that the common layer should contain only deterministic rules needed for uniqueness, interoperability, shared safety and security. Later changes become real through implementation and adoption, not publication alone. That rule protects the IGF as well as operators. The forum can recommend without becoming responsible for hidden implementation consequences.

For each proposed change, NRS should identify the invariant at stake, exact text, affected service, implementation evidence, compatibility impact, transition period, cost, refusal path, review and remedy. A purely technical profile may proceed through conformance testing and operator adoption. A rights change needs explicit contractual authority and notice. A public-law requirement needs the relevant legal instrument and jurisdiction.

The response to an IGF recommendation can therefore be substantive without being automatic: adopted, tested, piloted, rejected, referred, or held pending evidence. The public record should explain which. An "impact" claim without this chain is institutional marketing.

The IGF cannot certify that execution occurred

Once a recipient reports action, the IGF faces its own temptation to overclaim. A session summary may say that a problem was "addressed" because NRS announced a policy. A later message may cite the announcement as implementation. Neither proves that a record changed, an operator could port, a reviewer reversed an error or a successor service worked.

Forum follow-up should ask for the evidence appropriate to the act. For registration, inspect the authorized before-and-after state and public receipt. For service quality, examine response and correction times. For portability, observe a controlled migration with duplicate prevention and rollback. For review, record outcomes, reasons and whether relief was executed. For continuity, test recovery from provider failure.

The IGF can compare that evidence and publish unresolved questions. It should not issue a seal of operational validity. Its entities may lack access to protected records, and the forum has no day-to-day role in the service. Independent auditors, counterparties, operators and technical observers may supply different pieces of proof.

This limit improves discussion. The forum need not defend an implementation simply because it once recommended the idea. It can report that a recipient accepted the principle but failed the operational test. Institutional distance preserves the IGF's ability to ask the next question.

NRS cannot treat forum attention as recognition

The reciprocal risk is that NRS will cite an IGF panel, speaking invitation, report or referral as evidence of global legitimacy. That would recreate the very mandate inflation NRS is meant to resist.

The IGF's open character means actors with competing views can appear in the same programme. A topic's inclusion shows that programme organizers considered it worth discussing. It does not show that entities endorsed a speaker, that absent operators consented, or that the UN recognized a service provider. A forum handoff shows that someone believed NRS might hold a relevant lever. It does not grant the lever.

NRS communications should use exact language: received a referral from a named group; responded under a named service relationship; implemented a change for adopting operators; participated in a session. It should not say that the IGF selected NRS as the global registry, endorsed its model or authorized it to represent resource holders unless an explicit instrument actually does so.

This restraint is a competitive advantage. A provider that disclaims borrowed authority invites scrutiny of its actual service. Recognition then grows from interoperable adoption, accurate state, continuity and practical exit. Prestige cannot substitute for those proofs, and refusal to use it as a substitute makes the institutional claim more credible.

A registration error shows the layers at their best

Consider a pattern of stale or incorrect holder records affecting operators across several regions. Individual tickets reveal fragments. Researchers observe mismatches. Security teams encounter failed contacts. Smaller operators report long correction delays. No single actor can show the whole institutional pattern.

The IGF can convene these accounts, distinguish measurement error from registry error, compare regions and publish a problem statement. It can ask registries and prospective alternatives to disclose correction standards, response times, evidence requirements and review routes. It can preserve disagreement about privacy and public access.

NRS can act only on records within its adopted service. It authenticates the requester, assesses provenance, notifies affected parties, corrects supported fields, records the prior state and issues a receipt. If the dispute concerns a record served elsewhere, NRS can offer a portable evidence package or refer it; it cannot rewrite another provider's state by declaration.

The forum then follows the systemic question. Did recipients publish standards? Did measured correction time improve? Did NRS's portable receipt work across clients? Which disputes remained unresolved and why?

No layer becomes redundant. The IGF makes dispersed failure legible. NRS converts verified evidence into a bounded state change. Operators and observers verify the consequence. The authority of each claim remains visible.

Portability is where execution must become physical enough to test

Provider portability is easy to praise and difficult to execute. It requires a complete state export, authenticated consent, preserved history, dispute status, key and certificate planning, a defined cutover, duplicate prevention, rollback and acceptance by relying systems. A forum can expose lock-in and recommend portability. It cannot perform these state transitions.

NRS's positive claim should therefore rest on demonstration. An adopting operator should be able to move a record between qualified providers without renumbering, losing valid provenance or asking the incumbent for discretionary permission. Both providers should calculate the same uniqueness result at cutover. External observers should be able to verify that one coherent state succeeded another.

The IGF can contribute by bringing together operators with different scale, geography and dependency. It can reveal that an export adequate for a large provider is unusable for a small network, or that legal and RPKI dependencies make a nominal migration illusory. It can publish test scenarios and compare results without choosing the winner.

If NRS fails a migration, the correct response is not to invoke forum support. It is to preserve service, disclose the bounded failure, correct the interface and rerun the test. Portability is the point at which institutional claims meet observable execution. The discussion layer improves the test population; the execution layer must still pass.

RPKI incidents require more than two actors

Resource Public Key Infrastructure makes the limits of a simple two-box diagram visible. A hosted or delegated certification authority issues signed entities; repositories publish them; relying-party software validates them; caches deliver validated data; operators decide how route-validation state affects routing. NRS and the IGF occupy only parts of that chain.

An IGF discussion can surface a certificate revocation, repository outage, key-control dispute or unequal access to delegated service. It can compare the public-interest consequences and ask who controls each dependency. NRS can execute only the credential or service acts authorized within its adopted design. It cannot make every relying party fetch data or command every router to reject or accept a route.

RFC 6480 defines the RPKI architecture, and RFC 8210 defines delivery of validated data to routers. Their separation supports a multi-actor incident receipt. Which certificate changed? Which repository published it? When did validators observe it? Which operator policy produced a route consequence?

The handoff record should name each lever instead of sending one broad demand to "the Internet community." NRS can own its authorized act, the IGF can own the public account, and operators can own local routing decisions. Complexity becomes manageable when responsibility is disaggregated rather than rhetorically unified.

Public-law requests must arrive as law, not forum sentiment

Governments have responsibilities for security, competition, consumer protection, sanctions, crime, infrastructure and rights. Officials may use the IGF to explain a concern, hear transnational effects and identify the institution capable of acting. Their presence in a forum does not itself create an order.

If a public authority seeks an NRS record restriction or disclosure, NRS should require the legal instrument, issuing authority, jurisdiction, entity, scope, duration and available challenge. It should separate mandatory compliance from voluntary cooperation and publish as much aggregate information as law and safety permit. The affected operator should receive notice unless a valid restriction applies.

The IGF can examine whether similar requests create fragmentation, inconsistent safeguards or hidden extraterritorial effects. It can recommend due-process standards and cross-border cooperation. It cannot convert a minister's intervention into global law, and NRS cannot cite an IGF debate as legal cover for a discretionary restriction.

The same discipline protects states. A government should not discover that a private provider treated informal diplomatic language as a command and attributed the consequence to public authority. Requiring an operative instrument places responsibility where it belongs.

The layered model is not anti-government. It gives public law a clearer entry point while denying both the forum and the registry the power to manufacture it.

Abuse complaints must not expand the registry into a content police force

Abuse is a predictable test of institutional scope. Victims and investigators may bring urgent evidence to an IGF session. Operators may want better contacts and faster coordination. Governments may seek effective remedies. Registries may be pressed to act because they control a visible administrative record.

The discussion layer can separate functions. Which network carried the traffic? Which service hosted the content? Which operator can investigate a customer? Which authority can compel evidence? Which registry field is inaccurate? The answer may require action by several institutions, but not every concern belongs in a number record.

NRS should correct false contact or control information, preserve evidence under lawful conditions and enforce duties explicitly connected to its narrow service. It should not decide the legality of speech, adjudicate every abuse allegation or extinguish a number-resource relationship merely because a complainant lacks another convenient lever. Emergency security action needs a defined technical risk, limited duration, recorded reasons and rapid review.

The IGF can publish whether referrals reached the right institutions and whether gaps remain. It should not shame NRS for refusing an act outside its mandate. A justified refusal may be evidence that another remedy is missing.

Thin institutions remain thin precisely when pressure is greatest. Otherwise, the execution layer will accumulate every public problem that the discussion layer can name.

Emergency power needs a continuity floor

Some incidents cannot wait for ordinary review. Compromised credentials, conflicting control proofs, active duplicate registration or a destructive unauthorized change may justify a temporary hold. The existence of emergency conditions does not justify undefined power.

NRS should publish the triggering conditions, permitted temporary acts, maximum initial duration, authorization roles, evidence threshold, notice rule, independent review time and restoration duty. An emergency hold should preserve the last uncontested state where possible rather than reallocating the resource. Any exception to notice should be narrow and documented for later review.

The IGF's role begins before and after the event. In advance, it can compare emergency standards across services and bring smaller operators into scenario design. Afterward, it can examine aggregate evidence, whether the institution stayed within the rule and whether a recurring incident reveals a broader policy gap. It should not direct the live response from a conference channel.

Continuity is the shared outcome but not a shared command. NRS preserves service and evidence through its operational authority. Operators manage routing and customer continuity. Public authorities use emergency law where applicable. The IGF preserves public learning.

A layered system is resilient when emergency pressure clarifies responsibility instead of collapsing it into the institution with the loudest microphone or nearest database.

Transparency must preserve an evidence boundary

An auditable handoff does not require indiscriminate publication. Registration disputes may contain corporate records, security details, personal data, confidential contracts, sanctions information or evidence whose exposure would enable account takeover. The IGF's preference for open proceedings and NRS's duty to explain decisions must coexist with legitimate protection.

The issue record should classify material by function: public claim, public supporting source, protected operator submission, restricted legal material and security-sensitive evidence. It should identify who holds each category, who may review it and what public summary can be released. Submitters must know whether material will be transmitted to NRS before sharing it.

NRS's public response can disclose the rule, evidence types, findings, action, time and review outcome without exposing raw credentials or private identities. An independent reviewer or auditor can confirm that protected material existed and was considered. Redactions need reasons and later review where sensitivity expires.

The forum should resist two errors. First, secrecy must not become a blank space in which an institution asserts evidence that no accountable person can inspect. Second, openness must not become a condition that excludes the operators most exposed by disclosure.

The boundary is successful when the public can evaluate authority and procedure while protected parties can submit the evidence needed for a correct act.

Funding should not create a hidden supervisory relation

The permanent IGF needs sustainable resources, and an execution-capable NRS would need reliable funding for secure systems, staff, audits, review and continuity. Money can connect the layers in ways their mandates do not.

If NRS sponsors a forum programme, funds participation or seconds expertise, the contribution should be disclosed with restrictions and selection roles. The IGF should not grant programme influence, favorable language or recognition in exchange. If governments or UN-linked projects fund NRS research, the arrangement should not create an informal command over records. If operator fees finance advocacy, NRS should distinguish mandatory service cost from voluntary public work.

Separate accounts make the boundary visible. Registration, rights administration, portability, security and continuity should have stated costs. Advocacy, events and policy research should not be buried inside an unavoidable execution charge without authorization. The IGF should publish donors and programme effects; NRS should publish service financing and conflicts.

Funding transparency cannot eliminate influence. It can reveal where to look. A referral involving a major donor should carry the same evidence and jurisdiction tests as any other. A well-resourced entity should not be able to turn repeated discussion into privileged execution.

The relationship is complementary only if neither institution can purchase the other's authority.

The IGF needs metrics that fit discussion

Attendance remains useful for access planning but weak as a measure of influence. A discussion-layer scorecard should follow the movement of information and responsibility.

For each issue, record who introduced it, which affected groups were absent, what evidence was available, what disagreement survived and which institutions received a handoff. Record whether recipients acknowledged, accepted, referred, declined or ignored the request. Later, record the independent act, if any, and whether it addressed the original problem. Corrections should remain visible.

The IGF should also measure translation. Did operators understand the public-law concern more precisely? Did officials identify the technical constraint? Did smaller networks gain access to the actual service or policy venue? Did an intersessional group preserve knowledge between annual meetings? These are meaningful forum outputs even where no institution adopted the recommendation.

Negative results belong in the record. A recipient's reasoned refusal can clarify scope. A recommendation that proves technically unworkable should reduce repetition. A session that reveals limited public evidence evidence should not be promoted as consensus.

These metrics reward the IGF for being an excellent discussion institution. They do not ask it to claim the execution of others. The forum's influence becomes more credible when attribution is conservative and follow-up is persistent.

NRS needs metrics that fit execution

NRS should be judged by observable service and rights outcomes. Registration accuracy requires sampled error rates, provenance completeness, correction time and recurrence. Availability requires external measurement of query, update, authentication and export functions, not only the uptime of a public page. Portability requires successful migrations across independently controlled providers, including failure and rollback tests.

Rights performance needs its own ledger. How often was notice delivered? How much time did operators have to respond? Which evidence categories supported adverse action? How many decisions were reviewed, corrected or withdrawn? Did stays preserve continuity? Were remedies executed? Aggregate publication should protect legitimate confidentiality while exposing institutional patterns.

Continuity tests should assume NRS itself fails. Can another qualified provider reconstruct state, authenticate operators, preserve disputes and resume service without a discretionary blessing from the failed institution? Are keys, software, formats, documentation and funds available? How long does recovery take?

Adoption must be reported by meaningful status: member, contracted service user, active record, interoperable counterparty and relying operator are different measures. A large membership count does not prove execution.

These metrics give the IGF and the public material to discuss without giving them control. More importantly, they give operators evidence for choosing whether to rely on NRS. A replaceable institution can ask to be trusted on performance rather than permanence.

Independent verification belongs between the layers, not above them

The handoff model needs verifiers, but it should not create a new supreme body. Different claims call for different checks. Technical auditors can test conformance, security and migration. Accountants can examine service costs and restricted funds. Independent reviewers can assess individual adverse decisions. Courts can resolve legal disputes within jurisdiction. Researchers and operators can measure public behavior.

The IGF can convene these findings and expose conflicts. NRS can contract for audits and implement remedies. Neither should appoint one verifier whose conclusion becomes universal truth across every function.

Independence must be practical. A reviewer paid entirely by NRS may still be credible if appointment, tenure, access, publication and removal are protected. An academic study may still carry funding or data-access limits. An operator measurement may reflect its topology. Each result should disclose method and constraint.

Thinking Clearly About Multistakeholder Internet Governance argues for disaggregating Internet-governance functions rather than applying one institutional formula to all of them. Verification should follow the same discipline. The person qualified to test an RDAP response is not automatically qualified to decide a contractual right or legal order.

Plural verification limits capture while preserving accountability at the point of action. It is a bridge of evidence, not a third layer of command.

The model should survive disagreement between the institutions

Complementarity does not require harmony. The IGF may conclude that an NRS rule harms smaller operators. NRS may find that a forum recommendation would create conflicting records. Governments may challenge both. Operators may split on adoption.

The boundary should make disagreement productive. The IGF publishes the evidence, dissent and requested change. NRS answers with its authority, technical analysis, operator impact and decision. Critics can test the stated mechanism. Adopting operators use contractual review or exit; public authorities use law; other providers can offer a compatible alternative if uniqueness is preserved.

No institution should punish disagreement by misdescribing status. NRS should not mark an operator invalid merely for declining an optional future profile. The IGF should not exclude a recipient merely because it rejected a recommendation. Debate becomes coercive when access to the microphone or record is conditioned on agreement.

Forking is also bounded. Optional services and profiles may diverge. The globally unique identifier state cannot become two simultaneous truths for the same relying set without defeating the purpose of coordination. A disagreement about governance must not be disguised as duplicate registration.

The system's maturity will be visible when it can preserve accurate common state while allowing institutions to disagree openly about everything that need not be common.

A staged 2026-future adoption path

The first stage is documentary. NRS publishes a capability register, narrow service charter, rights schedule, data model, portability specification, emergency rule, review design and funding separation. The IGF publishes a standard issue-and-handoff record with explicit artifact status and consent rules.

The second stage is experimental. A small group of consenting operators tests record import, authenticated correction, complete export, provider succession and rollback using non-destructive environments and independently controlled implementations. Forum entities observe and critique the evidence without being asked to endorse the provider.

The third stage is limited service. NRS undertakes defined functions for contracted users, publishes external measurements and operates independent review. Handoffs involving those functions receive real responses; matters outside scope are referred. Counterparties test whether receipts and state can be consumed without custom institutional trust.

The fourth stage is substitutability. Another qualified provider imports the same portable state and performs a planned succession. NRS demonstrates that its failure or replacement does not erase operator rights or create duplicate authority. This is the decisive test of the bookkeeper principle.

The fifth stage is broader adoption based on evidence. Operators, relying systems and counterparties decide whether the service is useful. The IGF continues to expose gaps and compare outcomes. No ceremony converts a pilot into global authority. Scale follows interoperable reliance, accountable service and practical exit.

Failure modes should be named before launch

The most obvious failure is forum capture: well-funded entities dominate the issue record and present their preference as global demand. Contributor disclosure, dissent, artifact status and evidence review reduce but do not eliminate that risk.

The second is registry expansion. NRS receives referrals on every Internet controversy and begins treating responsiveness as a reason to acquire new powers. A published scope test and requirement to name the registration or rights lever should force most matters elsewhere.

The third is legitimacy laundering. NRS cites IGF attention as recognition, while forum organizers cite an NRS announcement as proof of impact. Exact attribution and execution evidence break the circular claim.

The fourth is confidentiality failure. Open discussion exposes operator evidence, or closed review hides unsupported action. Classified evidence handling, accountable reviewers and reasoned public summaries are needed.

The fifth is dependency without exit. NRS performs well, gains adoption and becomes the next irreplaceable gatekeeper. Regular succession exercises, portable formats, independent implementations and operator-controlled credentials are the answer.

The sixth is fragmentation. Competing providers create inconsistent truths rather than portable service around one uniqueness invariant. Conflict rules and observable cutover must precede competition.

Naming these risks does not weaken the model. It defines the tests by which a positive institutional proposal earns credibility.

Conclusion: a boundary can be a form of cooperation

The IGF and NRS do not need to merge, compete for sovereignty or deny each other's value. They need an interface that converts public attention into accountable institutional response without converting attention into authority.

The IGF's permanent platform can discover dispersed harms, compare evidence, translate among governments and operators, preserve dissent, publish recommendations and return to unanswered questions. Its openness is strongest when it does not pretend that a report updated a registry or bound a network.

A future NRS can authenticate adopted operator relationships, maintain accurate and portable number records, execute corrections, protect continuity and provide notice, reasons, review and remedy. Its positive claim is strongest when it does not pretend that membership represents all operators or that an IGF invitation confers public mandate.

The handoff between them should be visible from beginning to end: issue, evidence, submitter, recipient, requested act, receipt, jurisdiction, authority, response, execution proof, review and follow-up. Silence remains silence. Referral remains referral. Adoption remains a separate choice. Legal force remains attached to law. Routing remains attached to operators.

This is not a weak compromise between a talking shop and a registry. It is a stronger allocation of institutional labor. Discussion widens the evidence available to those who act. Execution gives public debate a named counterparty and testable result. Reciprocal restraint prevents either layer from using the other as camouflage.

The future two-layer settlement can be stated in one rule: the IGF may send any well-evidenced question, and NRS may execute only the acts it can lawfully, technically and contractually own. Everything else must remain visible as influence, refusal, referral or work still to be done.

Sources