Summary

  • The NRS Charter argues that number-resource bodies should be bookkeepers rather than regulators. The useful financial implication is narrower than the rhetoric: compulsory or dependency-backed charges should fund accurate registration, authentication, publication, interoperability, dispute correction, security and continuity, not give an administrator an unrestricted claim over every activity it can associate with Internet stability.
  • NRS is not listed by IANA or RFC 7020 as one of the five recognised Regional Internet Registries, and its public pages describe a membership and advocacy organisation. This article therefore proposes a finance constitution for NRS's own representation records and for any future registry-service model it advocates; it does not treat NRS as the current authoritative number registry or infer operating costs that its public materials do not disclose.
  • "Pay for the ledger" does not mean pay only for a database server. RIPE NCC's 2026 plan budgets EUR 5.665 million for its Registry division, but related record access and assurance sit elsewhere, including EUR 2.880 million for the LIR Portal, EUR 1.160 million for RPKI, EUR 700,000 for the RIPE Database and EUR 840,000 for DNS and K-root inside a EUR 41.125 million institution. Those published allocations are evidence of functional complexity, not a template or a verified minimum.
  • A defensible NRS model needs three financial rings: a base service account for measurable ledger functions; separately approved accounts for advocacy, events, research or policy campaigns; and a bounded continuity reserve. Contributions must not buy votes, admission, endorsements, faster corrections, privileged evidence treatment or control over the records of non-contributors.
  • The positive test is operational. A payer should be able to trace the charge to service units and standards; export its records and mandate history; challenge an adverse decision before an independent reviewer; inspect reserve and refund rules; and withdraw optional authority without endangering authoritative registration. Finance should make the ledger durable and the administrator replaceable.

The bookkeeping principle needs a balance sheet

"Just be a bookkeeper" is easy to applaud because it sounds like modesty. It is harder to finance. A number-resource institution cannot keep globally useful records with a clerk, a spreadsheet and a modest hosting bill. It must verify organisations, preserve a chain of registration, publish data, authenticate changes, protect credentials, answer disputes, coordinate reverse DNS, support transfers, operate secure systems, retain evidence, survive attacks and make its state intelligible to other registries and network operators.

The slogan becomes useful only when it distinguishes those costs from the costs of institutional power. A ledger function records a justified change and makes the current state available. A gatekeeper decides who may enter, which interests count, how far its jurisdiction reaches and whether a resource holder may continue to operate. Some decisions are unavoidable: records cannot be changed on an unverified email, and conflicting claims need resolution. But the administrator should not finance an ever-wider authority merely by describing each new intervention as protection of the ledger.

Money reveals the boundary more reliably than mission statements. If every annual contribution enters one unrestricted account, the organisation can fund record custody, advocacy, conferences, political campaigns, litigation, sponsorship, grants and executive growth from the same dependency. Members may vote, but the base fee has already bundled the choices. If the institution controls a record that the payer cannot safely abandon, payment becomes a weak signal of consent.

NRS has an opportunity to make its critique institutional rather than rhetorical. It can define what an operator is buying, publish the cost, separate optional authority and return excess. It can apply that discipline to its own membership and representation records before urging existing registries to adopt it. An organisation seeking to restrain gatekeepers should not finance itself through the same ambiguity.

The central proposal is therefore a cost constitution. Base charges pay for a verified service ring. Wider programmes require separate approval and a visible price. Reserves protect continuity within a band. Surplus leaves unless members authorise another use. Funding cannot purchase representation. Exit preserves records and evidence. The balance sheet does not merely report this constitution; it enforces it.

Begin with what NRS is, not what it aspires to change

The NRS Charter presents the Number Resource Society as a defender of accurate number registration and a critic of bureaucratic control. It describes the number-resource body's central function as maintaining correct registration and repeatedly invokes the "bookkeeper" idea. The NRS membership page offers individual and network membership without a listed membership charge, while its terms give an Admission Committee discretion to accept or reject applicants.

Those pages are evidence of NRS's stated design, not proof that every premise is correct or every safeguard exists. They do not make NRS an authoritative registry. IANA's number-resource overview identifies AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC as the Regional Internet Registries in the global hierarchy. RFC 7020 documents the same structure: IANA at the top, RIRs serving Local Internet Registries and other customers, and LIRs serving resource consumers. NRS is better treated on the current public record as an advocacy and membership organisation operating around that system.

This distinction protects the argument. NRS can maintain a ledger of its own members, verified network status, mandates, objections, evidence and representation authority. It can research and advocate registry reforms. It can help operators understand fees and record risks. None of those functions entitles it to charge for authoritative address registration, promise globally recognised changes or speak for operators that did not authorise it.

A future service role would require more than software and membership. It would need recognised authority, lawful custody, interoperable state, defined liability, data protection, security assurance, dispute resolution and a succession arrangement accepted by the relevant actors. Finance cannot manufacture recognition. It can show whether a proposed institution is built to deserve it.

The cost constitution should therefore contain two schedules. The first covers NRS as it exists: membership verification, mandate records, research, representation and member support. The second is a model for number-resource record services that NRS advocates or may one day participate in. No fee or public claim should blur the two. A contributor to advocacy has not bought a registry service; a verified network member has not delegated every policy position; a public register maintained by NRS is not the IANA-RIR hierarchy.

Institutional restraint begins with an accurate noun. Before NRS can ask others to remain bookkeepers, it must label its own books.

The ledger is a set of verifiable services, not a cheap server

RFC 7020 is helpful because it describes the Internet Numbers Registry System as a hierarchy designed to distribute globally unique IP addresses and autonomous system numbers. The record is not valuable merely because data exist. It is valuable because entities recognise the allocation chain, changes follow applicable policy, and the current state can be relied upon across organisational boundaries.

RFC 7249 adds an inventory perspective, documenting registries for autonomous system numbers, IPv4 and IPv6. IANA's public allocation pages and monthly performance reports show the operational consequences. Number-resource requests have acknowledgement, response, implementation and accuracy targets. Reverse-DNS changes move through an API and are measured for acknowledgement, propagation and availability. A quiet month can contain few requests while the service still must remain available.

At the regional level, the service ring is broader. It includes maintaining organisation and resource records; authenticating authorised contacts; processing allocations, assignments and transfers; correcting errors; publishing RDAP or Whois data under applicable access rules; operating reverse-DNS administration; maintaining resource-certification systems; protecting signing and account credentials; retaining an audit trail; responding to incidents; and preserving recoverable copies in another failure domain.

It also includes due process. A ledger that can be changed cheaply but incorrectly is not efficient. Verification effort, notice, reasoned decisions and independent correction are part of record quality. The administrator must be able to reject fraud without acquiring an unreviewable power to punish lawful but unpopular operators. Appeals are not optional politics around the ledger; they are error control for the ledger.

This definition prevents two opposite mistakes. Incumbents cannot place every public-policy ambition inside "registry security." Reformers cannot promise a trivial fee by counting only storage and code. The minimum service is technologically and legally serious, yet bounded. Its outputs can be named, measured and tested.

NRS should publish a service catalogue in verbs rather than departments: verify, register, update, sign, publish, resolve, restore, export and hand over. Each verb should have a service population, standard, unit, direct cost, shared-cost rule and failure consequence. If an expenditure cannot be connected to one of those verbs, it does not enter the compulsory base merely because management believes it benefits the Internet.

The ledger is therefore substantial. The gatekeeper is everything financed beyond that substantial, testable ring without a fresh mandate.

Existing RIR budgets reveal complexity, not the price NRS should copy

RIPE NCC's 2026 Activity Plan and Budget is unusually useful because it allocates people and operating expense across activities. The total operating budget is EUR 41.125 million. Within it, the Registry division is EUR 5.665 million: EUR 2.700 million for Registration Services, EUR 1.450 million for Member Services and EUR 1.515 million for Registry Monitoring.

Related technical functions sit in the EUR 12.800 million Information Services division. The plan allocates EUR 2.880 million to the LIR Portal, EUR 1.160 million to RPKI, EUR 700,000 to the RIPE Database and EUR 840,000 to DNS and K-root. Other information services include RIPE Atlas, RIPEstat, the Routing Information Service and internal technical support. External Engagement and Community receives EUR 9.800 million. Organisational Sustainability receives EUR 11.945 million.

These lines cannot simply be added into a universal "ledger price." K-root serves a DNS function beyond member registration. RPKI is closely tied to resource authority but has its own trust and security architecture. The portal supports member administration as well as registry changes. Finance, legal, facilities and information security are shared. Some community and training work may improve record quality indirectly. The allocation method is the institution's planning view, not an independent activity-based cost audit.

ARIN's 2025 budget makes the same point in another accounting shape. It shows USD 30.670 million of approved revenue and support, USD 32.146 million of approved operating expenses, USD 23.992 million for salaries and benefits, USD 1.910 million for engineering operations and infrastructure, and separate amounts for professional services, industry support, outreach and administration. It does not divide every employee between record custody and wider governance.

The comparison supports three conclusions. Registry service has large fixed and shared costs. Current organisations combine it with broader functions. Public budgets do not yet supply a harmonised, audited minimum-cost benchmark.

NRS should resist both imitation and cherry-picking. Copying the full incumbent budget would reproduce the scope it criticises. Citing only RIPE NCC's EUR 700,000 database line would ignore authentication, portal, security, RPKI, support and organisational continuity. The proper next step is a clean cost map built from services, not a percentage discount applied to someone else's total.

Put money into three rings and forbid silent migration

A financial constitution can make the service boundary durable by creating three rings.

Ring one is the ledger service account. It includes the verified service verbs: identity and authority checks; resource and mandate records; secure change handling; public interfaces; authentication; audit history; correction; appeal administration; backup; tested restoration; interoperability; essential legal compliance; and the share of common infrastructure demonstrably required to deliver them. Revenue may come from base membership, service charges or contracted support, but expenditure remains restricted to the catalogue.

Ring two contains chosen collective activity. Advocacy, policy campaigns, research beyond operational assurance, conferences, fellowships, media work, grants and institutional partnerships may be valuable. They receive separate budgets, approval and reporting. Funding can be voluntary, time-limited or allocated through an explicit member vote. A Ring-two deficit cannot be filled from ledger fees without a new authorisation.

Ring three is continuity capital. It protects Ring one against revenue interruption, cyber recovery, legal handover, banking failure and supplier collapse. Its target comes from scenarios and liquid needs, not a multiple of the entire institution. It cannot become an endowment for Ring two. Investment risk, access time and currency must be disclosed.

The essential rule is non-migration. Management cannot move a programme into Ring one by renaming it security, education or stakeholder trust. The finance committee cannot use Ring-three earnings for ordinary expansion. Shared staff and systems require a stable allocation key based on time, usage or another auditable driver. Material judgement changes are published with their fee effect.

For NRS itself, Ring one would initially be modest but real: secure membership and network verification, mandate and revocation records, evidence custody, publication controls, privacy protection, member support and portability. Advocacy belongs in Ring two even when it promotes the bookkeeper principle. If NRS later performs a recognised registry service, the catalogue and Ring-one budget would expand only after the authority, interfaces and liabilities are defined.

Three rings do not eliminate disagreement over classification. They make the disagreement consequential. A proposal placed in Ring two must win support on its merits. A reserve request must name a failure scenario. A core service must publish a measurable output. Finance stops being the place where boundaries disappear.

Allowed revenue should follow cost and performance, not institutional appetite

Once the service ring is defined, annual allowed revenue can be calculated as a transparent constraint rather than the amount an institution believes members will tolerate.

A workable expression is:

allowed ledger revenue = efficient direct service cost + allocated shared cost + approved renewal and security investment + reserve adjustment - external service income - prior over-recovery

Efficient direct cost comes from the catalogue and staffing plan. Shared cost follows a published allocation. Renewal covers capital replacement, security improvement and necessary technical debt, with milestones. The reserve adjustment moves continuity capital toward its band in either direction. External income includes contract revenue attributable to the service. Prior over-recovery reduces the next charge or funds a return.

Performance belongs beside cost. A cheap registry that misses changes, cannot restore records or leaves appeals unresolved is not efficient. The institution should publish availability, change accuracy, correction time, age of unresolved disputes, credential incidents, backup tests, export success, interoperability failures and cost per service unit. IANA's number-resource performance reports demonstrate that acknowledgement, implementation, accuracy and availability can be reported without turning every case into public personal data.

The formula should use a rolling three-year view for investment and staffing while settling cash annually. That reduces incentives to defer necessary work for a one-year saving. It also exposes structural growth. If cost per verified organisation or managed record rises, management explains whether the cause is security, complexity, service quality, lower denominator or inefficiency.

An independent cost reviewer should test the map every few years, but members retain the scope decision. Accountants can decide whether shared cost was allocated consistently; they cannot decide that a policy campaign belongs in the base because it may improve legitimacy.

Allowed revenue is a ceiling and a funding commitment. NRS should not promise a fee below the cost of safe records merely to demonstrate contrast with RIRs. Nor should it collect the ceiling automatically if a smaller amount will deliver the service. The annual budget states the efficient requirement, and the settlement rule returns favourable variance.

This design makes ambition visible. A larger institution is possible. It just cannot grow by redefining appetite as ledger cost.

Charge for the service burden, not the scarcity value of the resource

Internet number resources can carry substantial economic value, especially transferable IPv4 space. That value does not establish the cost of maintaining a record. A registry that charges a percentage of address-market value can collect scarcity rent unrelated to verification, publication or security. It also acquires an incentive to influence transfers, valuations and recognised title.

The NRS finance principle should reject value capture as the default. Fees should reflect service burden, shared fixed cost, risk and an equitable access policy. They should not rise merely because a /16 is more valuable in a secondary market than a /24.

No single fee basis is perfect. A flat account fee is simple and recognises shared cost, but it can burden small networks and encourage organisations to consolidate accounts. A resource-based tier can reflect scale and ability to pay, but address quantity is an imperfect proxy for work. Transaction charges connect cost to transfers or complex changes, but high charges can deter accurate updates. A per-ASN charge may encourage return of unused identifiers, yet the cost of keeping one clean ASN record is not necessarily the fee.

A balanced schedule could combine a modest verified-operator contribution, a capped scale component and direct charges for unusually costly optional transactions. The scale curve should be shallow enough that it does not monetise scarcity. Security, ordinary corrections, record export and appeal access should not carry punitive transaction fees. Ability-to-pay relief should use transparent criteria and should not reduce voting or service rights.

For NRS's current association role, membership can remain free while specific services receive transparent financing. Free entry is not free operation: donations, contracts or sponsors still bear cost. The accounts should show which service each funding class supports. If a donor underwrites small-operator verification, the donor receives a report, not control over verified mandates.

Every schedule needs incidence analysis. Publish common examples for a community network, a single-AS enterprise, a regional provider, a large multinational and a national intermediary. Show how much revenue each class supplies and whether the class generates identifiable service cost. Do not claim perfect fairness. Make the trade-off legible.

The resource is scarce. The right to administer its record should not become a licence to charge the holder for the scarcity an administrator did not create.

Contributions must never purchase a larger voice

NRS presents itself as giving network operators greater influence. Its finance model will fail if influence follows money.

The risk exists even with free membership. A sponsor can fund events, staff, travel, research or verification. A large operator can supply data and legal assistance. A service vendor can donate infrastructure. Each contribution can create gratitude, access and agenda power without buying a formal vote.

The constitution should separate payer identity, service entitlement and representational authority. Paying a larger fee may support a larger service burden, but it does not generate more mandates. Sponsoring a meeting does not count as operator support for a position. Funding a report does not make its conclusion an NRS view. Donating software does not grant control over member records.

NRS needs a public funding register showing legal donor, amount or in-kind value, purpose, restrictions, connected officers, procurement relationships and benefits delivered. Thresholds can protect small personal donors, but material organisational support should be visible. Tailored benefits require approval outside fundraising staff. Entity or member data must never be an unlisted sponsor benefit.

Representation should come from explicit, scoped and revocable authority. A verified network may authorise NRS to carry a position on a named issue until a date. The record should distinguish support, objection, abstention and no response. It should not infer a mandate from membership fees, event attendance or continued use of a service.

Financial concentration also needs a limit. If one donor can withdraw enough revenue to stop core verification, NRS will anticipate that donor's preferences even without a request. Ring one should survive loss of the largest non-service contributor. Ring two programmes can end when voluntary funding ends, but the public record must preserve their evidence and disclose the closure.

This separation is positive for responsible funders. A donor that receives no policy privilege should be able to prove it through the register and the constitution. The institution can accept useful support without forcing observers to guess whether money purchased the noun "member" or the sentence "operators support."

The finance test is simple: remove a contribution and ask whether the contributor's recorded authority changes. If it does, NRS has financed a gatekeeper rather than a ledger.

Admission and disputes are where a low fee can conceal a high power

NRS's public terms say the Admission Committee may request information and has discretion to accept or reject an application. Some discretion is necessary. A membership system needs to deter impersonation, duplicate accounts and false claims to network status. But a free price does not make discretionary admission harmless.

Admission determines who may appear in the membership denominator, use member services and contribute an operator mandate. If criteria are vague, the committee can shape the electorate and the public claim without charging a cent. Finance matters because verification staff, appeals and independent review cost money. Underfund them, and discretion concentrates in a small committee with little capacity to explain or correct decisions.

Ring one should therefore include due-process cost. Publish objective eligibility classes and required evidence. Give an applicant notice of missing information, a reasoned decision, a correction period and an appeal to a body not responsible for recruitment or fundraising. Report aggregate applications, approvals, rejections, reasons, processing times and reversals. Protect identity evidence from public disclosure.

The same structure should govern contested mandates and resource-related claims. NRS may verify that an organisation appears in a recognised registry, but registry data can be stale, layered through a parent provider or disputed after a merger. A resource record is evidence of a relationship, not a universal proof of who may speak for every operational dependency. The verification method should state what it proves.

Fees must not alter this path. A paying service customer cannot receive a lower evidence standard. A sponsor cannot bypass admission. A non-paying applicant cannot be placed behind commercial corrections where a public claim is being made in its name. Expedited service may be defensible for optional administrative convenience, but not for substantive rights or appeal.

An independent reviewer needs a budget protected from the committee it reviews. A small levy within Ring one can finance the function; appointment, term and reporting belong in the constitution. Cost bonds or filing fees should be waived where they would bar a plausible challenge.

This is the less glamorous part of "pay for the ledger." Accurate boundaries require paid correction. Cheap gatekeeping merely transfers the cost to excluded people and unreliable public claims.

Security, RPKI and interoperability belong inside the core

A narrow registry can still be technically ambitious. Security is not mission expansion when it protects the authenticity, availability and recoverability of the record.

The core budget should include strong account authentication, privileged-access control, signing-key protection, software maintenance, vulnerability response, logging, independent testing, incident response and geographically separated restoration. It should fund data minimisation and privacy controls because identity evidence can expose staff and networks. It should maintain an immutable history sufficient to reconstruct who changed what under which authority.

RPKI complicates the boundary. Resource certificates and Route Origin Authorisations connect registry state to routing-security decisions. They are more than a public address book, yet they authenticate claims derived from number-resource holdings. If an institution offers RPKI, safe operation belongs in the ledger ring: certification authority controls, repository availability, revocation, manifests, incident handling and holder tools. General routing-security advocacy or unrelated research can remain separately authorised.

Interoperability is equally core. RFC 7020 describes a hierarchy, not isolated private lists. A record service must exchange or reconcile data with recognised authorities, preserve stable identifiers, publish machine-readable state and expose versioned interfaces. It should make bulk export and verified snapshots possible without leaking protected personal data. Portability reduces the administrator's gatekeeping power because continuity no longer depends on one interface or corporate shell.

NRS should finance open specifications and conformance tests before financing a grand central platform. Its own mandate and membership records should have documented export, revocation and provenance. If it proposes a number-resource service, it should publish how records map to IANA and RIR authority, how conflicts are labelled, and what happens when another recognised source disagrees. It should not overwrite uncertainty with an NRS assertion.

Service standards need consequences. Repeated availability failure should trigger remediation funding and external review. A security incident should not automatically justify a permanent budget increase; the institution should show cause, control, residual risk and sunset. Savings from automation should be visible in unit cost or service improvement, not absorbed without explanation.

Paying for security is compatible with paying only for the ledger. The test is whether the control protects the record and its users, can be measured, and remains transferable to a successor. Security that merely protects institutional discretion from challenge belongs outside the core.

Optional advocacy should have an explicit sponsor and an expiry date

NRS is an advocacy organisation. Asking it to stop advocating would remove much of its current purpose. The financial discipline is not silence; it is separation.

A policy campaign should identify the proposition, target forum, evidence plan, authorised member base, budget, funders, staff and end date. NRS may take an institutional position under its governing rules, but it must distinguish that position from verified operator mandates. A general donation can fund approved advocacy within a published envelope. A restricted donation should disclose the restriction and cannot determine the conclusion.

Events should publish gross cost, entity revenue, sponsorship, in-kind support and benefits granted. Research should disclose commissioning terms, investigator independence, data rights and publication guarantees. Candidate education and election activity need especially strong separation: funding cannot purchase endorsement, access to voter data or preferential presentation.

Expiry matters because optional programmes tend to become base cost. Every material Ring-two activity should end or face renewal after a defined period. Renewal papers should show result and full recurring cost. Staff may be employed across periods, but the institution should not convert a temporary campaign into an argument that continued funding is necessary to avoid redundancy.

Members should be able to support one activity without financing all. This can be done through designated contributions, project votes or a capped collective allocation. It need not become a marketplace where only popular short-term causes survive. A democratically approved common fund can support research and participation, provided the amount and scope remain visible.

NRS should also report rejected funding. A short aggregate record of offers declined for control, conflict, privacy or reputational reasons demonstrates that the financial firewall operates under pressure. A reserve for Ring-two wind-down can protect publication and staff obligations when a donor leaves, but it should not preserve the programme indefinitely.

The positive result is sharper advocacy. A position financed transparently, based on labelled mandates and capable of expiring is harder to dismiss as a donor's campaign. Financial restraint can give NRS more authority precisely because it claims less.

Reserves should buy succession, and excess should go back

An essential ledger cannot depend on next month's donation or invoice. NRS needs continuity capital for any service whose sudden loss would corrupt records, expose identity evidence or strand active mandates. A future recognised registry service would need a substantially stronger reserve.

The target should be built from scenarios. How long can verification and publication continue if the largest payer leaves? What does incident recovery cost? How much is needed to retain critical staff through handover? Which liabilities survive closure? How quickly can cash and investments be accessed in the operating currency? The result should be a lower trigger, benchmark and upper trigger expressed in months of Ring-one stress cost.

The reserve must finance succession as well as survival. Escrow current code and documentation where appropriate. Maintain tested backups and export keys. Identify a lawful custodian for protected evidence. Rehearse transfer to a successor or orderly closure. A reserve that only keeps the incumbent alive can entrench the gatekeeper; a reserve that makes the service portable protects the ledger.

Above the upper trigger, excess Ring-one revenue should reduce the next charge or return to payers under a pre-existing formula. If membership remains free and service is donor-funded, unused restricted money follows donor terms while unrestricted residual can replenish an approved general band or support a separately authorised activity. It should not silently enlarge executive discretion.

The return formula needs a denominator. Service over-recovery can be allocated by eligible charges paid, while general donations should not purchase a financial claim unless terms say so. Departing service users should retain an earned credit for a reasonable period. The accounts should distinguish invoice credits, cash returns, unclaimed balances and amounts legally unavailable for distribution.

Deficits receive symmetric treatment. Ring-three capital can cover a temporary Ring-one shortfall. Repeated deficits trigger a fee or cost review. Ring two cannot drain the continuity reserve except under an explicit emergency resolution that states how and when the amount will be restored.

This design makes the reserve a constitutional instrument. It gives NRS enough independence to reject a controlling donor, enough time to repair a service, and too little latitude to finance permanent expansion from contingency.

Audit the boundaries, procurement and people, not only the total

An unqualified financial audit can establish that accounts are fairly presented under the applicable standard. It cannot prove that a campaign was correctly classified outside the ledger ring, a sponsor bought no influence, or a shared employee spent the reported time on core service. NRS needs assurance aimed at its constitutional boundary.

The annual report should reconcile revenue and expense by ring; show related parties; list material donors and in-kind support; disclose executive and board compensation; report procurement concentration; explain shared-cost methods; and publish reserve liquidity, investment risk and draw. Restricted and unrestricted funds should remain distinct. Comparative figures should preserve classification changes.

An independent service-cost review can sample staff time, contracts, cloud accounts, security spending and legal invoices against the catalogue. It should identify judgement rather than pretend every allocation is exact. Findings receive owners and dates. Repeated exceptions affect the next fee.

Procurement is a particular risk for a small institution. A founder, major donor or board-connected supplier can become both financier and beneficiary. Material tenders should disclose criteria, bidders in aggregate, conflicts and decision authority. Sole-source purchases need a reason and expiry. Donated technology should be valued and reviewed for security, lock-in, data rights and exit cost.

Compensation should follow service responsibility and comparable labour, not the economic value of addresses or the organisation's growing reserve. Performance incentives can use record accuracy, restoration tests, member support, appeal timeliness and cost control. They should not reward fee revenue, number of adverse actions, membership claims or funds raised from parties affected by policy positions.

Governance costs themselves belong in the map. Board support, elections, ethics, minutes and independent review make authority accountable. Allocate the portion needed for the service ring and place wider advocacy governance in Ring two. Do not hide all leadership expense in a general overhead percentage.

The audit question is not simply "where did the money go?" It is "did money cross the authority boundary?" An NRS finance constitution is credible only if an outsider can answer that from the report.

Start small enough that failure remains reversible

NRS should not launch a global finance model by announcing a low universal fee and a large institutional promise. It should prove the constitution in stages.

In the first year, publish the two service schedules: current NRS functions and the future registry-service model. Build ring accounts for membership verification, mandate records, advocacy and continuity. Release the service catalogue, funding register, conflict policy, admission criteria, appeal route and record-export specification. Establish baseline unit costs without claiming that early figures are efficient.

In the second year, commission an independent cost review and run portability exercises. Selected members should create, amend, revoke and export mandates. A successor environment should restore a sanitised test record. Admission and appeal reports should show time, outcomes and reversals. Ring-two projects should face their first expiry decisions.

In the third year, set the first prospective allowed-revenue envelope and reserve corridor. If paid services exist, publish fee incidence and settle over- or under-recovery. Stress-test loss of the largest donor and service supplier. Invite external technical review of interfaces and security claims.

Any move toward authoritative number-resource service requires a separate gate. NRS would need to identify the legal and technical authority, counterparties, recognition path, data source, conflict rules, liability, service standards, cost and succession plan. A demonstration record should remain labelled as such. Operators should not be asked to depend on it before interoperability and correction are proven.

Success should be measured by smaller claims and lower dependency, not institutional size. Can a network see what it paid for? Can a member withdraw a mandate without losing service? Can a rejected applicant appeal? Can records move to a successor? Can advocacy continue without borrowing the authority of the ledger? Can the core survive a donor's departure? Does excess leave?

The pilot report should publish failed tests as well as successful ones. A restoration that exceeded its target, an export that lost decision history, an appeal that exposed a conflict or a cost allocation that could not be reproduced is useful evidence. NRS would gain more credibility by narrowing a promise after such a result than by declaring readiness from a polished demonstration. Reversibility is not only a technical property; it is the institution's willingness to stop, correct and ask again before other operators depend on it.

NRS's positive contribution would be to turn the bookkeeper principle into a set of enforceable financial separations. It need not prove that every incumbent activity is wasteful. It needs to show that a common record can be secure, adequately funded and protected from appropriation by its administrator.

Pay for verification, publication, security, correction, interoperability and continuity. Pay transparently for advocacy when members choose it. Do not pay a scarcity rent to the entity that controls the entry. Do not let donations purchase the public voice. Do not let reserves make the incumbent irreplaceable.

That is a finance model worthy of a ledger: enough money to keep the record trustworthy, and enough constraint to keep the record-keeper ordinary.

Sources