Operator Mandates That Expire

Summary

• Every number-resource operator mandate should identify four things in a durable public record: the principal that grants authority, the functions and limits within scope, the start and expiry of the term, and the process for suspension, revocation and orderly succession.
• The principal is not simply whoever signed a service agreement. The record must trace authority from the Society's governing instruments and valid policy decisions to the body empowered to appoint, supervise and replace the operator.
• Scope should be expressed as specific capabilities over defined resources and states. Maintaining records, publishing RDAP data, processing transfers, operating reverse DNS and supporting route-security services are distinct powers and should not be bundled into an undefined right to act for the community.
• Duration changes the burden of justification. Before expiry, removal may require a stated trigger and fair process; after expiry, continuation requires fresh authorization. Automatic renewal should be limited, visible and incapable of turning silence into perpetual authority.
• Revocation must work at both legal and technical levels. A resolution that removes the operator is ineffective if the former operator still controls credentials, domains, repositories, supplier accounts, data copies or the only staff who can restore service.
• Internet authorization standards offer a useful design analogy: OAuth separates the resource owner, client, scope, token lifetime and revocation, while signed claims can record issuer, audience and expiry. Institutional mandates need the same explicitness, with stronger reasons, review and continuity safeguards.
• Expiring mandates do not invite unstable political rotation. Fixed terms, independent performance evidence, cure periods, emergency containment, prequalified successors and tested handover can preserve operational competence while preventing incumbency from becoming an unlimited community proxy.

Operation and authority are different assets

The operator possesses capabilities. It can authenticate a holder, commit a record change, publish registration data, sign or publish route-security material, maintain reverse-DNS delegation, answer a court order and restore service. The principal possesses the authority to decide who may exercise those capabilities and under what rules. Sound governance keeps the two connected but not merged.

In practice, the connection often disappears from view. Staff refer to what the registry decided when the decision was actually made by an operating company. Public statements use the community's name even though no policy body considered the issue. Contracts describe services, while the power to interpret policy, preserve disputed state or reject an instruction rests in informal custom. Because the same operator has acted for years, historical performance becomes its own authorization.

That condition is risky even when the incumbent is competent. A court cannot identify the correct respondent or understand whose legal interest is represented. Members cannot tell whether replacing a supplier changes policy authority. Holders cannot distinguish a rule from an operator preference. A continuity provider may receive data but no lawful ability to act on them. The operator itself may face conflicting instructions from a board, policy body, affiliate and regulator.

The mandate record resolves these questions by separating institutional layers. It states the source of the Society's authority, the appointing principal, the operator as authorized service provider, the specific delegated functions and the conditions under which authority returns or passes to another provider. Corporate ownership, employment, credentials and physical custody are recorded as implementation dependencies, not treated as the source of legitimacy.

This separation is familiar in other settings. A bank's payment processor can execute messages without owning customer funds. An appointed share registrar can maintain a shareholder record without becoming the company. A public concessionaire can operate infrastructure without acquiring the state's full regulatory authority. The analogies are imperfect, but they show why operational control should not be allowed to rewrite the constitutional relationship.

For number resources, the difference must survive stress. If the operator becomes insolvent, compromised or disobedient, the Society should not have to invent a new theory of authority while service is failing. The mandate should already show which powers stop, which minimum actions continue temporarily and who can activate a successor.

The principal must be identifiable and competent

Naming a principal is more difficult than placing an organization in a field. A service agreement might be signed by the Society's chief executive, a subsidiary or a board chair. That signature proves execution, not necessarily authority to delegate every listed function. The mandate record must trace the chain back to a governing instrument and a valid decision by the body competent for the subject.

Different functions may have different principals. Members may approve the constitutional purpose and appointment architecture. A policy body may establish allocation and transfer rules. A board may select and finance the operator. An independent review body may direct preservation in a dispute. A continuity authority may activate a substitute after a verified trigger. Describing all of them as the community conceals the allocation of responsibility.

The record should therefore name both the ultimate institutional source and the immediate directing body. It might state that the Society, acting under specified articles and a dated member decision, authorizes the board to appoint an operator; that the board, under a recorded resolution, appoints a named legal person; and that operational instructions must conform to policies adopted by a separately identified body. This chain allows a reviewer to test each link.

Competence matters because a body cannot delegate authority it does not have. A board authorized to procure technical service should not grant the operator a right to make allocation policy. A policy council should not direct expenditure outside its financial powers. An emergency committee should not extend its own term. If several approvals are required, the mandate should identify them rather than relying on a broad signature block.

The principal also needs duties. It must monitor performance, provide lawful instructions, preserve funds for continuity, maintain a replacement mechanism and avoid using the operator as a shield. Outsourcing an action does not outsource accountability for the decision to authorize it. Where the operator exercises professional judgment, the boundaries and review route should still be clear.

Public identification of the principal prevents an operator from invoking a mystical community mandate. It can say which body instructed it, under which authority and within which function. If no competent principal can be named, the action lacks an institutional foundation even if it is technically possible.

Scope should be a capability map, not a paragraph of aspiration

Mandates often use phrases such as operate the registry, serve the community or perform all necessary functions. These formulations are convenient for procurement and disastrous for accountability. They do not reveal whether the operator may alter holder state, interpret an ambiguous policy, suspend service, share protected evidence, sign route-security material or make a public commitment on the Society's behalf.

A usable scope lists capabilities. For each capability, the record identifies the relevant resource class, data, permitted action, approval condition, output, prohibition and review route. Read access is separate from write access. Preparing a proposed change is separate from committing it. Publishing a record is separate from deciding the underlying holder. Emergency preservation is separate from final revocation.

The map should distinguish at least allocation-state administration, transfer processing, registration-data publication, protected evidence custody, reverse-DNS coordination, route-security certification or delegation, billing, communications, security response and continuity support. The fact that one operator performs several functions does not make them one power. Modular scope allows a compromised capability to be suspended without disabling the entire service.

Scope also needs subject limits. An operator authorized to verify the representative of a recognized holder should not decide beneficial ownership of the holder company unless the rules expressly require that determination and provide suitable evidence and review. An operator processing a transfer may verify policy compliance without approving the commercial price. A communications team may explain an outage without speaking for members on unrelated legislation.

Discretion should be visible. Some tasks are mechanical: publish an already approved record. Others require judgment: decide whether contradictory succession documents establish authority. The mandate should specify when staff may exercise judgment, which factors apply, when escalation is mandatory and who reviews the result. Hiding discretion inside an operations manual makes it harder to challenge while leaving its effects unchanged.

Finally, scope must include prohibitions. The operator may not use protected data for unrelated commercial purposes, subdelegate consequential powers without approval, condition core service on political agreement, retain authority after expiry, or assert ownership of the canonical record. A mandate that lists positive tasks but no negative boundary leaves too much room for authority to expand through convenience.

Resource and state limits make scope enforceable

A capability statement is incomplete unless it identifies what the operator can affect. Number-resource administration involves multiple states: available, reserved, allocated, assigned, pending transfer, disputed, returned, revoked or subject to a legal hold. Authority appropriate for one state may be dangerous in another.

For example, an operator may be allowed to complete a transfer only when both parties are authenticated, policy checks have passed and no hold exists. It may place a short security hold when credentials appear compromised, but only an independent reviewer may extend the hold. It may correct a public contact after verification, while a change of recognized holder requires a different decision path. These conditions can be represented as a state-transition table that staff, auditors and successors can apply.

Resource limits also matter. Authority over IPv4 allocations does not automatically extend to autonomous system numbers, IPv6 or special-purpose registries. Authority within one service region does not silently include another provider's records. A cross-provider transfer requires coordinated powers on both sides, not a unilateral claim by either operator.

RFC 7249 identifies the IANA registries associated with the Internet Numbers Registry System and distinguishes special-purpose values from ordinary allocation and registration functions. The document is not an operator mandate, but it demonstrates why the entity of authority must be exact. An operator should know which registry, resource class and policy source govern an action.

Temporal state is equally important. A pending instruction is not a completed right. A historical holder cannot authenticate a new change merely because its name appears in an old record. A successor operator should not replay an event that the incumbent already committed. Scope rules need transaction identifiers, predecessor-state checks and final receipts so authority is applied once to the intended state.

These limits make delegation enforceable through technical controls. Credentials can be restricted by service and environment. High-impact transitions can require dual approval. Logs can record which authorized capability produced each event. The legal mandate and technical access model should describe the same boundary. If the contract is narrow but the production credential can rewrite everything, the real mandate is the credential.

Duration changes who must justify continuation

An operator term should have a start, an end and a rule for the period between them. Without an end, removal becomes an extraordinary accusation against an entrenched institution. With an end, continuation is an ordinary decision that requires evidence of current authority, performance and suitability.

The term should be long enough to support investment, staff retention and operational learning. Constant replacement would increase error and weaken accountability because responsibility never settles. But duration should not exceed the community's ability to evaluate assumptions, technology, conflicts and market alternatives. A critical service can use a multi-year term with annual evidence and a formal renewal decision well before expiry.

The IANA Numbering Services SLA offers a useful example of term discipline. It automatically renews for five-year periods unless a party gives the required notice, and it anticipates a successor operator after non-renewal or termination. The lesson is not that five years or automatic renewal is universally correct. It is that duration, notice, performance oversight and succession can be designed as one system.

Automatic renewal requires caution. It may protect continuity when a decision is delayed, but repeated renewal by silence can recreate permanence. A Society could permit one short continuity extension if a timely replacement process is unfinished, require public reasons and independent approval, and prohibit the incumbent from voting or controlling the evidence used to justify extension. The extension should preserve minimum service, not create a new full term.

Renewal should examine more than uptime. The principal should review record accuracy, reconstruction results, security, transfer consistency, correction outcomes, conflicts, financial resilience, staff concentration, portability and cooperation with continuity tests. A high-performing operator may still be unsuitable if it has made itself irreplaceable or repeatedly speaks beyond scope.

The burden changes at expiry. Before term end, early removal should follow the agreed termination grounds and fair process unless urgent containment is necessary. After term end, the operator has no entitlement to continue merely because replacement is inconvenient. The principal must affirmatively grant a new mandate or activate a narrow transition authority.

Expiry must be an event, not a date hidden in a contract

Institutions miss expiry because dates are separated from operational dependencies. Legal staff know the term, security staff know the certificates, procurement staff know supplier renewals, and engineers know the accounts. Nobody owns the combined transition. When the date arrives, the safest immediate option appears to be allowing everything to continue.

The mandate record should generate a sequence of events. Well before expiry, the principal confirms whether renewal, competition or replacement will occur. The operator supplies a current dependency inventory and data export. Independent reviewers assess performance and portability. Potential successors demonstrate restoration. Holders receive notice of any material interface change. Credential transition is rehearsed. Final decisions are made early enough for challenge and cure.

At expiry, the record should identify the exact state of each power. Some credentials may terminate automatically. Others may remain active for a brief, supervised handover. The incumbent may answer historical questions but lose authority to commit new discretionary changes. A continuity operator may preserve service while the permanent provider is installed. These states should be decided in advance rather than improvised by whoever retains access.

Expiry also requires accounting. The incumbent should deliver the canonical record, ordered events, pending instructions, restrictions, audit evidence, current credentials or controlled replacement materials, supplier contacts and a statement of unresolved incidents. The successor should acknowledge receipt and produce a reconciliation report. Both should preserve evidence needed for later disputes.

The public does not need sensitive security detail, but it should know that the term ended, which authority now operates each function, whether critical services remained available and which unresolved risks are under review. Silence encourages rumors and allows two bodies to imply simultaneous authority.

The closing event should be recorded permanently. Years later, a reviewer should be able to tell when the old mandate ceased, whether any temporary extension applied, which actions occurred during handover and who accepted the successor state. Expiry then strengthens institutional memory instead of erasing it.

Revocation is a spectrum of bounded responses

Revocation is often imagined as a single dramatic act: the principal terminates the operator. Critical infrastructure needs more granular controls. A stolen credential may require immediate technical suspension without deciding the whole contract. Persistent service failure may justify a cure period. A conflict of interest may require removing one function. Insolvency may activate continuity while legal termination proceeds.

The mandate should distinguish containment, suspension, partial revocation, termination for cause, non-renewal and emergency succession. Each state needs a trigger, decision maker, evidence threshold, notice rule, review route and technical effect. Granularity protects continuity and proportionality. It prevents a dispute over one capability from becoming a threat to every service.

Containment can be immediate when delay presents a concrete security risk. The principal or a pre-authorized security officer may disable a credential, freeze high-impact changes or isolate a repository. The action should be narrow, logged and reviewed quickly by someone independent of the first decision. Emergency action should not become an unreviewed final finding.

Suspension pauses authority while facts are examined. During suspension, the operator may retain duties to preserve records, cooperate with investigation and support service under supervision. Partial revocation permanently removes a capability, such as handling protected evidence, while leaving other services intact. Full termination ends the mandate subject to handover duties.

Fairness matters because an operator may have staff, investments and reputation at stake, and a mistaken removal can harm the service. The operator should normally receive the allegations, evidence substance, an opportunity to answer and reasons. Urgent technical action can precede that process where necessary, but rapid independent review should follow.

Revocation must not depend on the operator's consent. If the same board officers who control the operator also decide whether the Society may remove it, the mechanism is circular. Independent triggers, conflict rules and access arrangements should allow authority to be withdrawn despite incumbent resistance.

Legal revocation fails if credentials survive

A board resolution cannot by itself stop an operator from acting. The former operator may still hold administrator accounts, signing keys, domain-registration control, cloud ownership, repository access, private communications channels, backup encryption keys and vendor authority. Outsiders may continue to accept its messages because no replacement trust path exists.

The technical revocation plan should map every credential to a capability and mandate term. Some credentials can expire automatically. Others require rotation, revocation or transfer. Shared secrets should be replaced rather than copied. Hardware-protected keys may need a ceremony or controlled rollover. Vendor accounts require pre-registered recovery contacts that do not report solely to the operator.

Internet standards again provide a useful analogy. RFC 7009 defines a way for an OAuth client to notify an authorization server that a token is no longer needed, allowing invalidation of the token and, in some cases, related authorization. Institutional revocation is more complex, but the principle is the same: withdrawal needs an operative endpoint and a known effect, not just a statement of intent.

Trust by third parties must also be updated. Peer registries, certificate issuers, auditors, banks, insurers, domain providers and courts may have stored incumbent contacts. The transition plan should identify who notifies them, how they authenticate the notice and when they stop accepting old instructions. A public mandate status service can give relying parties one current source without exposing operational secrets.

Data copies create another problem. Revocation ends authority to use the record but does not erase every copy. The former operator may need to retain limited evidence for legal defence or regulatory duties. The mandate should define return, protected retention, deletion, audit and prohibition on commercial reuse. An independent person should verify compliance where risk warrants it.

The decisive test is end-to-end: after revocation, can the former operator still cause a recognized state change or represent itself successfully to a material dependency? If so, authority has not actually been revoked.

Credentials prove capability, not constitutional legitimacy

A valid certificate, password or signing key shows that a system recognizes the presenter. It does not prove that the presenter has a current institutional mandate. This distinction is easy to lose because automated systems act on credentials at speed.

The mandate status should therefore be checked when consequential credentials are issued and renewed. A credential should identify the operator, authorized service, environment, audience and maximum lifetime consistent with the mandate. It should not outlive the underlying term except for a separately authorized handover purpose. Renewal should fail if the mandate is suspended or the relevant capability has been removed.

RFC 7519 describes signed claims including issuer, subject, audience, expiration and not-before time. RFC 6749 treats scope and token lifetime as express parts of delegated authorization. These standards concern application security, not institutional constitutions. Their value here is conceptual: the relying system should not have to infer who granted power, what it permits or whether it is still current.

Long-lived root credentials deserve special treatment. Some may be necessary for continuity or offline security. Their possession should be split, supervised and subject to activation procedures that refer to the mandate. No single executive should be able to use a dormant continuity credential merely by claiming an emergency. Conversely, emergency access should not require consent from the operator whose failure triggered it.

Logs should bind each consequential action to both a credential and a mandate version. That allows an auditor to distinguish unauthorized use of a valid credential, use after term expiry, action outside scope and ordinary processing error. The distinction informs remedy and prevents every incident from being described vaguely as a security issue.

Technical access control can never replace governance judgment, but it can enforce parts of a well-defined mandate. Governance rules become more credible when systems make violation difficult and evidence of violation durable.

Subdelegation is where scope quietly expands

An operator rarely performs every function itself. Cloud providers host systems, contractors review evidence, affiliates run support, vendors maintain security hardware and specialist firms assist with incident response. Each relationship can create a subdelegation even if the contract calls it ordinary outsourcing.

The mandate should distinguish commodity support from exercise of institutional discretion. A hosting provider that stores encrypted data may not decide holder status. A contractor who reviews identity material may influence a consequential decision and therefore needs stronger authorization, confidentiality, conflict and review controls. An affiliate communicating with holders should not imply that corporate affiliation gives it the Society's mandate.

Consequential subdelegation should require prior approval from the principal, a recorded scope, a term no longer than the main mandate and direct revocation rights. The operator should remain accountable for performance and should not create contractual barriers that prevent the Society from accessing data or replacing the subcontractor. Subcontract termination and assignment terms must align with continuity.

Subdelegation also occurs informally. A respected volunteer may be given an administrator role. A former employee may remain a recovery contact. A vendor technician may share credentials during an emergency. These arrangements are especially dangerous because institutional trust substitutes for recorded authority. Periodic access review should reconcile every active capability with a current mandate or approved sub-mandate.

Cross-border suppliers add legal complexity. Privacy, secrecy, sanctions, insolvency and evidence rules may affect transfer or access. The principal should know where critical material is held and what happens if local law prevents immediate handover. Concentrating every copy or key in one jurisdiction can make revocation ineffective.

The rule is not that the Society must operate everything directly. Specialization can improve resilience and security. The rule is that delegation must not disappear down a contracting chain. Every actor able to cause or approve a consequential state should be traceable to the principal, bounded in scope and removable without destroying the service.

The mandate record needs public and protected views

Not every detail of operator authorization should be public. Publishing credential identifiers, recovery channels or security architecture could create risk. Keeping the entire mandate confidential creates a different risk: members and holders cannot know who is empowered to act.

The public view should identify the operator's legal name, principal, authority source, functions, major exclusions, start date, expiry date, current status, renewal or transition state, public service contacts, independent reviewer and the date of the latest assurance. Material sub-operators should be named when their role affects reliance or data custody. Changes should remain in an accessible history.

The protected view should add decision instruments, named responsible officers, credential-to-capability mappings, supplier accounts, data locations, security contacts, financial guarantees, unresolved exceptions and detailed revocation steps. Access should follow role and need. Reviewers and continuity custodians require enough information to act without obtaining unrestricted visibility into every holder record.

Status values should be controlled and intelligible: proposed, active, restricted, suspended, transition, expired and revoked, for example. Each status has defined effects. A merely published label is not enough; systems, staff and relying parties should apply the same state.

Integrity matters because an incumbent could otherwise alter the evidence of its own authority. Significant mandate versions should be approved by the competent principal, time-stamped and preserved with prior versions. The operator may maintain the service that displays the record, but an independent custodian should hold a verifiable copy.

The record should connect to decisions without overwhelming the public. A renewal entry can link to a performance assessment and reasoned resolution. A restriction can state its function and duration while protecting sensitive allegations. Expiry can identify the successor and continuity outcome. This gives affected people a reliable map of authority rather than forcing them to interpret corporate announcements.

Community accountability requires more than the word community

Operators often justify authority by saying they act for the community. The phrase can describe genuine participation, but it can also obscure principal and scope. Which community acted? Through what body? Who was eligible to participate? What question was decided? How long does the decision remain current?

A membership vote can authorize a governing structure. It does not give an operator a perpetual blank mandate. Election of directors empowers them only within the governing instrument and term. Approval of a budget does not necessarily ratify every operational discretion. Silence from members is not consent to indefinite renewal when information or alternatives are unavailable.

The mandate record turns community authority into testable propositions. It identifies the member or policy decision, participation rule, quorum, conflict treatment and competence on which appointment rests. It also records objections and review routes where governing rules require them. That evidence protects the operator as well as critics because staff can show that a contested action fell within a valid grant.

Membership accountability should address concentrated participation. Operators and major resource holders may have greater ability to attend meetings, draft proposals or stand for office. Expiring terms create opportunities to reassess capture, but renewal cannot be a popularity contest that sacrifices technical competence. Independent performance data, conflict disclosures and open criteria make the decision less dependent on factional narrative.

Affected non-members need procedural rights where operator decisions touch their recognized interests. Notice, reasons, correction and review should not depend entirely on electoral status. A holder may be a customer rather than a member; an operator's authority over its record still requires fair exercise.

The community remains the source of parts of the institutional order, not a personality that the operator can permanently impersonate. A precise mandate allows collective authority to persist while providers change.

Courts need to know what can be ordered and who can comply

Disputes over number resources may involve corporate control, fraud, insolvency, contract, sanctions, membership or administrative process. A court order can arrive while several bodies claim authority. Without a mandate map, the court may direct the wrong entity or use broad language that does not correspond to technical functions.

The public record should help identify the operator responsible for the affected service, the principal capable of changing its mandate and the reviewer able to preserve state. A technical statement can explain whether the requested relief concerns a holder entry, pending transfer, reverse DNS, route-security service, credentials or evidence. These are related but not identical actions.

The operator should not claim that its technical role makes it immune from law. Nor should it treat any demand as self-executing without checking jurisdiction, authenticity, scope and conflicts with other obligations. The mandate can assign legal assessment, escalation and emergency preservation to specified officers while reserving final policy questions to the proper body.

Court and continuity planning must intersect. If an order removes directors or restrains an operator, service should not fail because only those people control the keys. If two orders conflict, the Society may need a narrow hold while seeking clarification. If an operator is insolvent, a liquidator should be able to distinguish corporate assets from records or credentials held for the Society's function.

Reasons and logs protect all sides. The operator can show which act implemented the order and which services remained unchanged. The holder can challenge overbroad execution. The successor can preserve the restraint without repeating or expanding it. The court can later assess compliance against a defined capability.

An expiring mandate makes no claim to override judicial authority. It makes judicial intervention more precise by revealing where operational power currently sits and when it should move.

Continuity authority should be dormant, narrow and ready

A successor cannot be invented at the moment of collapse. The Society should maintain a continuity mandate that is normally dormant. It identifies one or more prequalified providers, the activation authority, triggers, maximum duration, minimum functions and transition duties. Readiness is tested without granting ordinary operating power.

Triggers should be objective enough to resist factional use: sustained inability to provide a critical service, verified compromise of decisive credentials, insolvency that prevents performance, loss of lawful capacity, refusal to obey a final valid instruction, or expiry without a ready permanent operator. Some triggers require independent confirmation; an acute security event may permit immediate containment followed by review.

The continuity operator's scope is smaller than the ordinary mandate. It preserves the canonical state, keeps essential query and security services available, protects pending instructions, applies existing restraints and communicates status. New allocations, discretionary policy changes, commercial projects and structural decisions should normally pause.

Activation must include access. The provider needs current exports, documented interfaces, protected contacts, funds, domains or substitute endpoints, and a lawful basis to handle data. Restoration exercises should prove these elements together. A tabletop discussion that never tests credentials and reconciliation is not sufficient.

The dormant provider should not become a shadow incumbent. It should receive only the access needed for testing, operate under confidentiality, disclose conflicts and lose readiness status after its qualification period unless reassessed. Competition among possible successors can reduce dependence, but too many uncontrolled copies create security risk.

The continuity mandate itself expires. Otherwise an old provider may retain a latent claim years after its staff, ownership or capability changed. Regular renewal ensures that emergency authority remains as current and bounded as ordinary authority.

Performance evidence should support renewal without predetermining it

The operator will often possess the best operational data about its own performance. That creates a structural asymmetry at renewal. If the principal depends entirely on incumbent reports, the operator can define success and portray replacement as reckless.

The mandate should specify evidence from the start. Measures include availability by critical function, accepted and rejected changes, reconstruction accuracy, transfer elapsed time, security incidents, correction and review outcomes, unresolved exceptions, holder experience, staff concentration, financial resilience, subcontractor dependence and continuity-test results. Definitions should remain stable enough for comparison across years and operators.

Independent assurance should test high-consequence claims. It can sample record histories, observe restoration, verify active credentials against mandate scope, examine conflict handling and confirm that a successor receives usable information. Public reporting can aggregate sensitive findings while identifying material weakness and remediation dates.

Renewal criteria should include cooperation with replacement. An operator that meets uptime targets but blocks export, ties critical knowledge to proprietary tools or refuses realistic handover tests is failing an essential requirement. Portability is not an optional penalty imposed on a poor performer; it is part of competent performance from the first day.

Evidence should inform but not automate the decision. A score can hide distributional harm, emerging legal risk or a conflict that numbers do not capture. The principal should publish reasons connecting evidence, alternatives and continuity. Dissent should be preserved so later reviewers understand which risks were accepted.

The incumbent should have a fair chance to correct factual error in the assessment. It should not control the reviewers, selection criteria or timing. A renewal process that is either a ceremonial approval or an ambush will damage confidence. Predictable evidence and an open decision calendar support both accountability and operational stability.

Expiring authority does not require constant replacement

Critics of fixed terms often present a choice between permanent incumbency and disruptive rotation. That is false. Expiry requires a decision, not a new operator. A capable provider can receive a renewed mandate after comparative assessment, conflict review and proof of portability. The constitutional gain lies in the fresh grant and preserved alternative.

Long-term institutional knowledge is valuable. Number-resource records contain history, unusual cases and technical dependencies that are difficult to transfer. The mandate can support staff continuity across operator change, require documentation and allow phased handover. Employment expertise need not be owned by one corporate shell forever.

Procurement competition is also not the only renewal method. A membership institution may use a nonprofit affiliate or specialized public-interest body where market alternatives are limited. Even then, the principal can review scope, term, performance, conflicts and succession. Corporate affiliation should not erase the mandate boundary.

The greater risk is false stability. If no replacement is possible, the incumbent can underinvest, broaden its role or resist review because every sanction threatens service. Tested replaceability reduces that leverage. It may also improve cooperation, since the operator knows continuity information is a normal deliverable rather than evidence of distrust.

Renewal can be staggered by function. A stable record platform may continue while a communications or analytics service is competed separately. High-risk credentials can have shorter authorization cycles than the main service agreement. Modular terms avoid a single cliff and make performance evidence more specific.

The aim is durable service under temporary authority. Institutions become resilient when continuity does not depend on pretending that one provider is irreplaceable.

A model mandate record is concise but consequential

The core public entry can fit on one page. It names the Society as the institutional source, the competent appointing body as immediate principal and the operator's exact legal identity. It cites the governing provisions and decision that create the mandate. It lists authorized functions and explicit exclusions. It states the resource classes and service states within scope.

The entry gives the effective date, ordinary expiry, notice period, renewal method and any permitted transition extension. It names the bodies empowered to contain, suspend, partially revoke, terminate or activate continuity, with references to the applicable standards. It identifies the independent reviewer and current continuity provider. Finally, it records status and the latest assurance date.

Behind that entry sits a capability schedule. Each function has decision rights, required approvals, technical credentials, evidence duties, service levels, incident powers and handover materials. A dependency schedule maps staff, suppliers, domains, accounts, keys, repositories and funds. A transition schedule defines timed steps before and after expiry.

The record should answer a practical challenge. If a new reviewer arrived today, could that person determine whether the operator is authorized to make a disputed change? If the mandate ended tonight, could a qualified successor identify which actions it may take tomorrow? If a former operator sent an instruction next month, could a relying party reject it confidently?

This approach avoids two extremes. It does not publish sensitive operational detail. It also does not reduce authority to a broad contract known only to insiders. Public legitimacy and protected execution are connected through a common mandate version.

Regular reconciliation is essential. Corporate names change, subcontractors rotate, credentials are renewed and policy bodies amend rules. A mandate record that is not compared with live authority becomes ceremonial. The Society should test the match and report exceptions until corrected.

Four design failures should be treated as warnings

The first warning is a mandate without a principal. Phrases such as on behalf of the community or under historical authority are not enough. If no competent body can grant, supervise and withdraw the power, the operator is relying on status rather than authorization.

The second is scope defined by possession. An operator may argue that because it controls the platform, it can take any action needed to protect it. Security discretion is necessary, but it must be linked to bounded incident powers and review. Technical control does not create subject-matter competence.

The third is a term that renews indefinitely by silence. Continuity may justify a short extension, not perpetual authority. Repeated non-decisions indicate that the principal lacks capacity or that the operator has made replacement impossible. Both are governance failures requiring correction.

The fourth is paper revocation. A contract ends, but credentials, data, domains and public recognition remain with the former operator. The Society then has formal authority without operational power, while the former operator has operational power without current authority. This is the most dangerous split because each side can plausibly claim legitimacy.

Other signals include undocumented subdelegates, credentials longer than the term, no state-transition limits, an incumbent-controlled audit, reserve funds inaccessible to a successor, and public statements that equate criticism of the operator with opposition to the community. Each suggests that a bounded service mandate is becoming institutional entitlement.

Warnings should trigger proportionate response, not automatic removal. The principal can require correction, narrow credentials, commission assurance or accelerate a continuity test. But repeated failure to repair the mandate boundary should weigh heavily at renewal because it undermines the ability to govern every other risk.

Expiry preserves community authority by refusing to impersonate it

The durable interest is not the operator's tenure. It is the continued existence of unique, verifiable and safely administered number-resource records under legitimate rules. An operator serves that interest for a period. It may earn renewal through excellent performance, but it does not become the interest itself.

Naming the principal prevents vague appeals to community will. Defining scope stops operational convenience from expanding into general authority. Fixing duration makes continuation a decision rather than an inheritance. Making revocation effective ensures that a valid decision can change who acts without destroying the function.

These controls also protect the operator. Staff receive clearer instructions. Courts and holders can direct questions to the correct body. Security teams can align credentials with authority. The provider is less likely to be blamed for policy choices it did not make or pressured to act on conflicting informal demands.

Most importantly, expiry makes succession ordinary. The Society can plan for handover while relations are good, test restoration before failure and preserve institutional memory across corporate change. Replacement ceases to be an existential attack and becomes one possible outcome of a lawful term.

A community proxy becomes unbounded when history, possession and dependence substitute for an express grant. The answer is not distrust of operators or ritual turnover. It is a mandate record that remains current from appointment to closure and can be enforced in contracts, credentials, evidence and continuity arrangements.

The operator may be indispensable to today's service. It should never be indispensable to the community's authority over tomorrow's service. That is why the mandate must expire.