Summary
- Multistakeholder participation can improve evidence, expose institutional blind spots and influence rules. It does not give an operator a durable entitlement merely because a representative attended, objected or voted.
- Present RIR agreements demonstrate that number registration already rests on legal relationships, incorporated policies, service duties, termination powers and dispute routes. The problem is not an absence of instruments; it is that continuity, amendment, exit, liability and review remain strongly tied to the incumbent provider.
- A constructive NRS operator-rights agreement should protect verified standing, accurate records, notice, evidence access, continuity, proportionate treatment, portable registration, independent review and enforceable relief. Core protections should not disappear through an ordinary policy update or silence.
- Portable registration means that the same verified operator and number resources can change qualified registration service provider while one authoritative state, authenticated history, valid restrictions and linked technical dependencies are preserved. It is not a holder transfer and does not compel route acceptance.
- Independent remedy requires structural separation from the challenged provider, emergency preservation powers, conflicts rules, reasoned decisions, defined compliance time, court access and technical means to execute relief. An appeal to the same board that authorized the act may be review, but it is not independence.
- NRS should be judged by whether it binds itself to the disciplines it advocates: portability out, open formats, liability proportionate to foreseeable reliance, funded continuity and review, audited succession and no claim of authority before interoperability and recognition are earned.
Theatre describes visibility, not insincerity
The word theatre can sound accusatory. Here it describes an institutional form. A meeting has a stage, a programme, speaking roles, visible disagreement and a closing account of what occurred. Those elements can produce knowledge and pressure. They can also make access to the visible performance appear equivalent to possession of a right.
The entities are not necessarily acting. An operator who describes a registry failure may be reporting a real risk. A civil-society advocate may identify a genuine rights impact. A registry executive may explain a real technical constraint. A government official may possess lawful public authority. The problem is not sincerity. It is that the room combines people with radically different mandates and then uses one vocabulary of stakeholder participation to describe them.
A right operates differently. It belongs to an identified person or organization because a contract, law or governing instrument says so. It can be invoked outside the conference calendar. Its exercise does not depend on rhetorical ability, popularity or continued membership of the group that discussed it. A decision maker must answer it under a stated standard. A remedy addresses breach.
Theatre can help create a better right by exposing facts and testing language. It should never be the condition for using the right. If an operator must attend repeatedly to prevent an adverse interpretation, preserve a registration or obtain ordinary service, participation has become an informal toll on continuity.
The institutional design question for 2026 and beyond is therefore not whether to end meetings. It is how to place enforceable operator protection somewhere meetings cannot grant or withdraw it.
The operator is the party carrying the operating downside
Internet number governance often uses overlapping labels: member, resource holder, registrant, Local Internet Registry, customer, sponsor, network, lessor, lessee and operator. They are not interchangeable. A rights architecture must identify which legal person controls the registration interest and which organization carries the network risk.
The operator in this article is the principal responsible for a live network and its dependencies. It signs customer and supplier contracts, configures routers, pays transit and infrastructure costs, handles incidents, answers regulators and carries availability obligations. Loss of accurate registration, reverse DNS support, certification capability or transfer recognition can affect that operator even when another entity is the formal resource holder.
Sometimes holder and operator are the same company. Sometimes a corporate group separates assets from operations. Sometimes a customer uses addresses under a lease or sponsorship arrangement. The contract should not solve this complexity by pretending it does not exist. It should identify the registered interest, operational authority, beneficial or contractual interests where relevant, and the scope of each party's standing.
Primary standing should attach to the verified holder or other recognized registration principal. Operational parties may receive defined notice, evidence or continuity protections through an authorized designation. Downstream customers should not acquire ownership merely because they depend on the network, but their reliance can constrain how remedies are timed and executed.
This precision matters because “operators want” is not an authorization source. NRS should not repeat the multistakeholder error by claiming to speak for every network. It should offer a contract that each qualified operator can choose, understand and enforce. The rights arise from the instrument and recognized state, not from a generalized claim of representation.
Participation access is not a durable entitlement
Open meetings, public lists and policy proposals are valuable. They let an operator warn others, contest a draft and contribute technical evidence. They can reduce insider control. They cannot guarantee that a particular operator's continuity survives a majority decision, a service dispute or institutional failure.
Participation imposes costs. A small network may have no employee who can follow years of specialist discussion. Time zones, language, travel, legal expertise and fear of commercial exposure shape who appears. Large institutions can distribute attendance across policy, legal and engineering teams. A regional access provider may send the person who is also responsible for keeping the network running.
Even perfect access would not solve the rights question. A person can speak and lose. Majority or consensus processes must be able to reject proposals. The constitutional problem appears when losing the discussion also means that the operator has no stable contractual floor, no continuity-preserving exit and no review outside the institution that won.
Silence is especially dangerous. Open processes sometimes treat lack of objection as support. That may be workable for developing a voluntary common practice among active entities. It is a weak basis for removing core rights from parties who were absent, unaware or unable to evaluate the effect. A contract can incorporate future operational detail, but material changes to continuity, portability, liability or remedy should require affirmative consent or a protected exit.
Rights outside attendance do not make participation irrelevant. They create a baseline from which participation is genuinely voluntary. An operator can contribute because the discussion matters, not because absence risks forfeiture.
Current agreements prove that the legal layer already exists
The modern number-registry system is sometimes described as if it were maintained only by technical cooperation. Public agreements show otherwise. Registration services are delivered through legal relationships that define rights, duties, incorporated documents, fees, amendment, termination, liability and governing law.
The ARIN Registration Services Agreement defines included number resources, registration services and contractual rights. Version 14.0 added a route for a customer to terminate if a service-term change is believed to have a material adverse impact. The RIPE NCC Standard Service Agreement forms a signed relationship, incorporates current policies and procedures, permits specified amendments without re-signing and addresses suspension, deregistration, termination, liability and Dutch law. The APNIC Membership Agreement incorporates APNIC documents as amended, defines revocation and appeal consequences and points disputes toward Queensland law and courts.
These instruments differ. They should not be flattened into one contract. Together they establish a simpler point: critical registration relationships are already contractual and juridical. The argument that operator rights would contaminate a purely informal technical system is historically and presently false.
The relevant reform question is what the contracts protect and who bears the residual loss. If a provider can alter material obligations through incorporated policy, terminate service, deregister resources or cap liability far below foreseeable network harm, the operator may carry most of the downside. Participation in the provider's association can influence that allocation. It does not replace a minimum rights floor.
NRS can work constructively because it need not invent the legal layer. It can redesign the allocation of duties within it.
Termination is not portability
The ability to end a service agreement looks like exit until the dependent state is examined. If termination also ends registration service, certification access, reverse DNS support or recognized standing, the operator can leave only by sacrificing the continuity that made the relationship important.
Current agreements provide forms of termination, transfer, merger recognition, sponsorship and account change. These mechanisms serve real purposes. A holder transfer changes the recognized party. A merger aligns records with a corporate event. Sponsorship can place an intermediary between an end user and a regional provider. An inter-RIR transfer may move recognized registration under compatible regional rules. None necessarily gives the same operator an ordinary right to replace only the service provider while preserving the same resources and authoritative history.
That distinction is central to the NRS project. Provider portability is not an unrestricted claim to take number resources free of valid obligations. It is a right to preserve verified registration while changing the institution that administers the service under common rules. The holder, resource identifiers and legitimate history remain; the provider changes.
A termination clause without portability can still be useful. It can reject adverse amendments or end unwanted membership. But its bargaining value is limited when the safe practical choice is to remain. The stronger right couples exit with continuity.
This article does not claim that the right exists today across the recognized system. It states the design NRS should make testable. The promise is not “you may leave.” It is “you may change qualified provider without making customers, routing history and critical registration state collateral damage.”
The NRS operator-rights agreement should be a constitutional contract
An ordinary service contract allocates performance and payment. An NRS operator-rights agreement would also set limits that participating providers cannot remove through routine administration. In that sense it is constitutional: it binds the service institution as well as the customer.
The agreement should name the operator or other registration principal, covered resources, current provider, governing law, dispute forum and recognized authoritative state. It should define service duties for record accuracy, authentication, notice, data access, reverse DNS dependencies, certification dependencies, transfer support, portability and continuity. It should state fees and the procedure for changing them.
A rights schedule should sit above changeable operating policies. The schedule would include verified standing, timely correction, reasons for adverse action, access to relied-on evidence, notice and cure, proportionality, protection of uncontested resources, portable exit, independent review, emergency preservation, enforceable relief and export on succession. Technical detail can evolve without reopening every signature. Core protections cannot.
The hierarchy of documents must be explicit. If a later policy conflicts with the rights schedule, the schedule controls unless the operator affirmatively accepts a valid amendment or law requires a different result. If an emergency requires temporary action, the provider must identify the power, scope, evidence, expiry and review route.
The contract should also state what it does not promise. Registration does not compel global routing. It does not settle every question of property, tax, insolvency or sanctions law. It does not immunize fraud. Precision strengthens the rights that remain because the provider cannot defend overreach through an undefined claim of stewardship.
Verified standing is the first operator right
A person cannot enforce a right if the institution can perpetually question who is entitled to invoke it. Identity and authority checks are necessary in a system where false documents, compromised accounts and corporate disputes can redirect valuable records. The checks should be rigorous, but they should end in a durable, reviewable standing decision.
The operator-rights agreement should identify authorized representatives, signing powers, escalation contacts and methods for updating them. It should preserve prior authorization evidence and record why a change was accepted. Corporate succession, insolvency, merger and delegated operation require defined evidence rather than ad hoc familiarity with staff.
Standing should be granular. A network engineer may be authorized to manage technical state without transferring the registration interest. Counsel may issue a dispute notice without creating a ROA. A service agent may maintain contacts without changing beneficial control. Separating powers reduces the damage from one compromised credential and prevents the provider from treating every contact as a universal principal.
The provider must also carry a burden. If it rejects standing, freezes an account or doubts documents, it should state the deficiency, preserve uncontested service where safe and provide timely independent review. “Due diligence” should not become an unbounded status with no evidence or date.
Once verified, standing should travel with portable registration. The receiving provider may perform risk-based checks, but it should not restart history from nothing or allow the incumbent to block exit through an unexplained identity dispute. Authenticated history and current authority are part of the portable state.
This is a right that no meeting seat can supply. It belongs in the signed relationship and can be invoked by the authorized operator from anywhere.
Record accuracy needs correction rights and evidence access
RFC 7020 places registration accuracy among the central goals of the Internet Numbers Registry System. Accuracy is not merely an institutional aspiration. For an operator, it can affect due diligence, transfer recognition, incident response, contactability and confidence in linked services.
An NRS rights layer should give the operator access to the material record concerning its resources: current state, authenticated changes, authority evidence, pending requests, restrictions, dispute status and provider decisions. Security-sensitive information can be protected, but the provider should not rely on undisclosed evidence to impair a registration without a defined exception and independent review.
Correction requires time limits. A clerical contact error should not enter the same queue as a disputed corporate succession. The contract can classify cases by risk and state target times. If a correction is refused, the provider should identify the conflicting evidence and the route to challenge it.
History must not be rewritten when a provider changes. A portable record carries both corrections and the fact that correction occurred. This protects the operator against a false adverse history and protects the system against a holder who tries to erase a legitimate dispute.
Public directory data and confidential evidence should be distinguished. Not every corporate document belongs in an open record. The operator nevertheless needs a verifiable receipt showing what was submitted, when it was assessed and which decision followed.
The right is therefore larger than “keep the record accurate.” It is the right to know the operative state, obtain reasons, correct error and preserve an authenticated chain across provider succession.
Core rights cannot be amended by ordinary silence
Number-resource agreements often incorporate policies and procedures that change over time. Dynamic incorporation allows technical and administrative systems to adapt without collecting thousands of signatures for every detail. The mechanism becomes dangerous when it can alter the rights that constrain the institution itself.
An NRS rights agreement should divide change into three classes. Routine technical changes can take effect after public notice when they do not materially impair operator rights. Material operating changes require an impact statement, a meaningful notice period and a continuity plan. Constitutional changes to portability, adverse-action standards, liability, independent remedy or succession require affirmative operator acceptance or a right to port before the change binds.
Silence should not be deemed consent to the third class. Many operators will not monitor every policy channel. A provider that relies on continued use as acceptance knows that leaving may be impossible without continuity loss. That is not ordinary consumer convenience; it is leverage produced by dependency.
Emergency law and security events need a bounded exception. A court order or immediate compromise may require action before consultation. The provider should record the authority, narrow the affected state, set an expiry and permit rapid review. Emergency power cannot become a permanent amendment route.
The ARIN version 14 change acknowledging termination after a materially adverse service-term amendment is a useful signal that contract change and holder protection belong in the same instrument. NRS should go further by ensuring that termination can preserve registration through portability.
A right that can be edited away by the duty-bearer is a policy preference. The rights layer begins where unilateral change stops.
Portable registration preserves the operator while changing the provider
Portability is often confused with transfer. A holder transfer changes who is recognized. Provider portability changes who supplies registration administration for the same recognized operator and resources. The distinction should appear in every NRS instrument.
The portable unit is not a row of text. It is a verified state. At minimum it includes the operator's identity and authority, covered prefixes or autonomous system numbers, registration history, current contacts, lawful restrictions, pending disputes, transfer status, linked reverse DNS responsibilities, certification dependencies and a signed indication of which provider is authoritative at the present moment.
One effective state is non-negotiable. Portability cannot allow two providers to make conflicting authoritative changes. The old provider's authority must end at the same defined transition point that the new provider's authority begins. The public indication of service responsibility must update in a way relying institutions can verify.
Continuity does not mean that every technical artifact remains unchanged. Some credentials may need to be revoked and reissued. Some service endpoints may change. The right concerns preservation of the operator's recognized position and safe continuity of dependent functions, not preservation of an unsafe credential merely because it existed before.
Portability must also carry obligations. Outstanding fees, valid court measures, fraud evidence and scoped disputes do not vanish. The receiving provider assumes service duties and respects recognized restrictions. The departing provider must export and cooperate; it does not receive a veto over a qualified move merely because the operator is leaving.
NRS can make this principle concrete by publishing an open portability specification, contract terms and conformance tests. Recognition should follow demonstrated interoperability, not branding.
The transition record must be atomic and auditable
A portable system fails if different institutions disagree about when authority moved. The transition needs a single auditable event with a defined pre-state, authorization, transition time, receiving-provider acceptance and post-state.
Before the transition, the operator confirms the scope and authorized request. The incumbent supplies the authenticated record and identifies unresolved restrictions. The receiving provider validates that it can assume the duties. A neutral coordination function verifies that the same resources are not entering conflicting transitions.
At the transition point, service authority changes once. The record should make replay and equivocation detectable. If a dependent function cannot move at the same instant, the continuity plan states which provider maintains it temporarily, under whose authority and until what deadline. Temporary dual service is different from dual authority.
Rollback must be defined before failure. A technical error immediately after transition may require restoration to the last valid state. Rollback should not become a political power for the incumbent to reverse an unpopular but valid exit. Trigger, evidence, time window and decision authority belong in the contract and technical specification.
Auditability serves both freedom and restraint. It lets an operator prove that a qualified port completed. It lets a relying party detect an unauthorized copy. It lets an adjudicator reconstruct which institution held responsibility when a disputed act occurred.
This article does not prescribe a complete implementation sequence for every provider. The essential rights test is narrower: the system must preserve one state, one responsible provider and an authenticated history at every material point.
RPKI continuity is a dependency, not a file export
The Resource Public Key Infrastructure makes portability technically demanding. RFC 6480 describes a certificate hierarchy tied to number-resource allocation, resource certificates, Route Origin Authorizations and publication. Authority is not safely moved by copying a private key or document into a new account.
A provider transition may require coordinated certificate revocation and issuance, repository publication, manifest freshness and holder confirmation. RFC 9286 shows why repository entity inventory and freshness matter. Stale or inconsistent publication can produce validation effects even when the underlying registration is not disputed.
The NRS contract should therefore promise a controlled certification transition where the provider supplies or coordinates that service. It should define the operator's chosen ROA intent, the last valid state, transition monitoring, recovery and evidence. Delegated certification and holder-controlled keys may change the technical allocation of responsibility, but they do not eliminate the need to coordinate trust and publication.
Routing remains separate. RFC 6811 defines origin-validation states; it does not order every operator to treat them identically. A successfully ported registration and valid RPKI state cannot compel global route acceptance. Operators retain local routing policy subject to applicable duties.
This limit is important for credibility. NRS should promise what its rights layer can preserve: recognized registration, authenticated authority and safely managed linked services. It should not claim a master switch over the Internet.
Disputes must travel without becoming permanent freezes
Portability creates an obvious objection: a holder might switch provider to escape an investigation, unpaid obligation, court order or competing claim. A safe rights layer must carry disputes forward.
The answer is a scoped hold, not general captivity. The record identifies the contested claim, affected resources, issuing authority, evidence status, expiry or review date and acts that remain permitted. A dispute about one prefix should not automatically freeze every resource held by a large operator. A billing dispute should not silently become a claim over unrelated routing continuity.
The receiving provider accepts the registration subject to the recorded hold. It does not retry the merits merely because the operator chose it. The independent adjudicator retains jurisdiction or a successor forum is designated. Evidence remains authenticated and available under appropriate confidentiality.
Valid final decisions follow the state. If a court orders correction, portability cannot defeat the order. If an adjudicator rejects the incumbent's claim, the hold must be removed promptly. If the dispute concerns the incumbent's own service performance, the incumbent cannot classify the exit itself as evidence of wrongdoing.
This design protects both sides. The operator can leave a provider it no longer trusts without erasing accountability. The system can preserve fraud and legal restraints without allowing an allegation to become an indefinite provider veto.
NRS should publish hold statistics with privacy protection: number opened, scope, age, disposition and time to release. A portable system that hides permanent freezes would reproduce monopoly under another name.
Independent remedy begins where internal appeal ends
Current systems provide forms of review. APNIC's agreement allows specified revocation concerns to be appealed to its Executive Council. RIPE NCC operates a Conflict Arbitration Procedure with selected arbiters, decision timing, enforceable directions, compliance periods and court access. Its published summaries show disputes involving transfers, termination, deregistration and billing.
These are meaningful mechanisms. They also illustrate why “appeal” and “independent remedy” should not be used interchangeably. Review by the same board that governs the provider may correct error but remains internal. An arbiter chosen within an institution can have procedural independence for a case while the institution still defines scope, funding and the contractual environment.
An NRS remedy body should be structurally separate from the challenged provider. Appointment should not be controlled by one side. Arbiters should disclose conflicts, parties should have a bounded challenge right, and terms should protect tenure for active cases. Funding should come from a standing arrangement that providers cannot withdraw to influence an outcome.
The standard of review must be stated. Some cases ask whether the provider followed procedure. Others ask whether evidence supports an adverse action, whether the contract permits it, whether a measure is proportionate or whether emergency relief is necessary. A body that can review only procedure should not be presented as capable of correcting the underlying state.
Independence is not a ceremonial label. It is the capacity to decide against the provider and make the decision effective.
Emergency preservation must arrive before final judgment
Final adjudication can be too late for a live network. If a registration is removed, a certification service interrupted or dependent state changed during a months-long dispute, customers and counterparties may react before the merits are decided.
The NRS rights agreement should authorize interim preservation. An adjudicator can maintain the last verified registration state, prevent irreversible reassignment, preserve necessary technical service or order a neutral custodian to hold state while evidence is reviewed. The order should be narrow, time-limited and revisable.
Interim relief does not decide ownership or final entitlement. It protects the possibility of an effective final decision. The applicant should show a serious issue, risk of irreparable or disproportionate harm, a balance favoring preservation and appropriate safeguards against abuse. The exact legal standard will depend on governing law; the contract can establish a compatible private route without displacing courts.
Customer continuity deserves attention but not automatic victory. A large operator cannot immunize a false claim by pointing to customers. The adjudicator can isolate contested resources, require security, preserve evidence and accelerate a decision. The objective is to stop institutional leverage from using unrelated users while keeping the merits open.
Emergency procedure needs an always-available contact, evidence requirements and a short decision target. A right to relief that can be filed only at the next annual meeting is not emergency protection.
This is where a rights layer most clearly differs from participation. The operator does not need an audience. It needs an order capable of preserving state tonight.
Remedy requires technical execution as well as a reasoned award
A beautifully reasoned decision is incomplete if no institution can correct the operative state. The remedy body must be connected to the registration and service architecture through pre-agreed execution duties.
Possible relief includes correcting a record, removing or narrowing a hold, completing a port, restoring access, preserving service, disclosing relied-on evidence, repeating a defective decision, paying damages or allocating costs. Not every adjudicator will have authority to grant every remedy. The contract should say which orders providers and the neutral coordination function must execute.
Compliance time matters. RIPE's published arbitration procedure, for example, specifies communication and compliance periods and preserves court submission. NRS should define similarly clear consequences. If a provider refuses an enforceable order, the coordination layer may transfer service authority, draw on a continuity bond or initiate accreditation consequences, subject to review.
Court access remains important. Private adjudication cannot override mandatory law or bind nonparties without a legal basis. Courts can support interim measures, enforce awards or review questions reserved by law. The NRS agreement should avoid both extremes: pretending private rules are sovereign, or making every operational correction wait for full litigation.
Published decisions improve consistency, with redaction where security, personal data or confidential commercial evidence requires it. Operators should be able to see how standards were applied without exposing vulnerabilities.
The test is practical: after winning, can the operator obtain the state the decision says it should have?
Liability should reflect foreseeable reliance
Registry agreements often limit warranties and financial exposure. Some limitation is understandable. A coordination service cannot insure every business loss produced by global routing, customer conduct or third-party action. Unlimited consequential liability could make service unaffordable or invite claims disconnected from provider control.
The opposite extreme is also unstable. If a provider can make a foreseeable, wrongful registration or continuity decision while exposure is limited to a small amount of fees, incentives are asymmetric. The operator carries customer, revenue, compliance and recovery risk; the institution controlling the record carries little financial consequence.
An NRS contract should classify loss by control and fault. Direct correction costs, emergency migration expense, independent-review cost and loss caused by intentional misconduct, gross negligence or refusal to comply with an order may receive different treatment from remote consequential claims. Providers can maintain insurance, continuity reserves or bonds for defined risks.
Liability is not the only remedy. Specific correction and preservation may matter more than damages. A fast port can prevent loss that money cannot repair. The contract should prioritize restoration while preserving proportionate compensation where provider breach caused measurable harm.
The operator has duties too: maintain accurate contacts, secure credentials, pay agreed fees, disclose relevant changes and cooperate with safe transitions. Contributory conduct can affect relief. Rights architecture is not immunity from responsibility.
NRS can distinguish itself by publishing the allocation honestly. A rights organization should not promise protection in public while reproducing nominal liability in its operative agreements.
NRS can convert a movement into an institution of rights
The NRS Charter and public descriptions emphasize accurate registration, operator freedom, transparency, accountability and limits on concentrated authority. NRS analysis links exit, redundancy and portability to resilience. Lu Heng's portability proposal argues directly that networks should be able to move registration relationships rather than remain locked to one regional provider.
These positions create a positive institutional opening. NRS can become the place where operator rights are specified with more precision than the systems it criticizes. It can publish model terms, an open portable-state specification, provider qualification requirements, independent-remedy rules, continuity funding and measurable service commitments. It can convene operators to test the design without claiming that attendance authorizes absent networks.
NRS already uses membership terms to form legal relationships. Membership, however, is not yet the same as portable registration or independent relief. The next institutional step is to make the binding instrument carry the substantive promise.
Success should be demonstrated in stages. A simulated transition can test data and RPKI dependencies. A limited voluntary service can test provider substitution and dispute carryover. Independent audit can test whether one effective state is preserved. Recognition discussions can then proceed with evidence rather than declarations.
NRS does not need to imitate a government or claim immediate control of the global registry hierarchy. It can earn authority by making operator rights technically safe, contractually enforceable and externally verifiable.
NRS must accept portability out of NRS
An institution that demands exit from incumbents but prevents exit from itself has not solved the structural problem. NRS and every participating provider should be subject to the same portability obligation offered to operators.
The operator should be able to export authenticated state in an open format, select another qualified provider and preserve history without NRS permission based on institutional preference. Fees can be due and valid disputes can follow, but service authority cannot be retained as bargaining leverage. Proprietary interfaces must not make a formally open exit unusable.
NRS should maintain an audited succession plan. If its coordination function fails, designated independent custodians should preserve the authoritative transition record and permit qualified service continuity. Funding for that plan should be segregated from ordinary advocacy or event spending.
Governance rights matter as well. Operators should know who can amend standards, accredit providers, appoint adjudicators and draw continuity reserves. Conflicts should be disclosed. Decisions affecting one provider should not be made by competitors without safeguards. Concentrated emergency power should expire and receive review.
The public claim should remain bounded. Until NRS has external recognition and working interoperability, it is a rights and service proposal, not an alternate source of global routing truth. Saying so is not weakness. It prevents the institution from using aspiration as authority.
Replaceability is the strongest proof of confidence. A provider that can be left must retain operators through service quality. A coordination institution that can survive succession has built continuity larger than its own brand.
Discussion and rights should remain separate but connected
The discussion layer asks what the rules should become. It gathers experience, hears affected groups, compares technical constraints and permits disagreement before institutions act. IGF sessions, regional meetings, NRS assemblies, research and public consultation all belong here.
The rights layer asks a different question: what does an identified institution owe an identified operator now? Its sources are contracts, recognized technical state, governing law and enforceable decisions. It needs evidence standards, deadlines and remedies.
The layers should communicate. Repeated disputes may reveal that a contract needs amendment. New security evidence may justify changing a portability standard. Operators using their rights can supply anonymized cases to public discussion. Forum recommendations can become proposed terms. The connection is learning, not substitution.
The distinction can be stated simply. A discussion output says who recommends what. A rights instrument says who owes what to whom. The first can be open-ended and persuasive. The second must be bounded and executable.
This separation also protects the discussion layer from capture by asset control. People should be able to debate number governance without fearing that losing the argument will immediately alter their registration. Conversely, a provider should not defend a breach by saying that the operator could have attended the policy meeting.
NRS can host both activities if it marks the boundary. Its meetings can develop ideas. Its contracts and accredited services must operate under the rights already in force until they are validly changed.
Recognition should follow proof, not replace it
The existing Internet Numbers Registry System coordinates uniqueness through IANA and five recognized Regional Internet Registries. ICP-2 addresses recognition of a regional institution and emphasizes support, neutrality, technical competence, record keeping and continuity. Current RIR governance reform considers emergency operation and institutional succession, while the Q1 2026 status report records unfinished questions about activation and holder protection.
NRS should engage this environment without claiming that self-declaration creates authority. Recognition must answer interoperability, security, continuity, dispute and accountability questions. How is duplicate state prevented? How does IANA or another global coordination function identify the responsible service? How do existing RIRs hand over authenticated history? How are RPKI and reverse DNS dependencies preserved? What happens when NRS fails?
Proof can be modular. Open specifications can be reviewed before institutional recognition. Conformance tests can show that providers produce the same state. Exercises can test failure and rollback. Independent legal analysis can identify jurisdictions where contract and award enforcement are credible. Operators can evaluate whether protections improve real outcomes.
The strongest recognition claim is not that NRS represents everyone. It is that NRS has built a safe, voluntary rights system whose records and transitions can be verified by institutions that do not share its politics.
Rights come first in the design; recognition makes them effective across the wider system. Neither can be supplied by meeting enthusiasm.
Security objections require controls, not permanent lock-in
Incumbent providers can make a serious case against casual portability. Number resources are globally unique. False authority can support hijacking, fraud or conflicting claims. Cross-jurisdiction moves can complicate sanctions, insolvency and court orders. RPKI transitions can create validation failures. A weak provider could become an entry point for record corruption.
These risks are real. They justify strong identity, provider qualification, one-state coordination, signed history, scoped holds, independent adjudication, conformance tests, audit and revocation of provider credentials. They do not prove that one permanent regional service relationship is the only safe design.
Lock-in has security costs of its own. Institutional failure, compromised credentials, prolonged litigation or poor recovery can concentrate risk. An operator unable to move may have no safe response when the provider itself is the failure domain. Portability converts institutional diversity into a continuity control if the transition standard is sound.
The rights agreement should prevent jurisdiction shopping for evasion. A valid legal measure follows the record. The receiving provider must meet common minimum standards and cannot advertise weaker verification as a competitive feature. NRS accreditation should be reviewable and separated from commercial favoritism.
Security analysis should compare systems under the same threat model: incumbent-only failure, malicious holder, malicious provider, compromised coordination function, conflicting courts, stale technical state and emergency succession. “Portability is risky” is incomplete without asking whether non-portability is safer under each case.
The purpose is not frictionless movement at any cost. It is controlled movement as an alternative to helpless dependence.
Operator-rights performance should be measured in exercised protections
NRS should avoid counting members, meetings or policy statements as proof that the rights layer works. The relevant measures concern actual use and outcomes.
Contract measures include the share of covered operators with a signed rights schedule, the number of material amendments requiring affirmative acceptance and the number of departures completed before an adverse change took effect. Record measures include correction time, reversal rate, unresolved age and completeness of authenticated history.
Portability measures include requests, accepted and rejected ports, reason codes, median and tail completion time, service interruption, rollback, duplicate-state incidents, carried disputes and dependency failures. The denominator must include failed and abandoned attempts.
Remedy measures include applications, emergency-preservation decisions, time to interim and final decision, provider compliance, court challenges, published outcomes, cost and retaliation complaints. Independence should be tested through decisions against every major provider, not inferred from organizational description.
Continuity measures include exercises, recovery time, state-loss incidents, reserve adequacy and successor readiness. Liability measures should report claims and restoration, subject to legitimate confidentiality, rather than advertise an insurance figure without experience.
No 2026 performance rate should be invented before the service exists. Baselines should be established at launch, methods fixed publicly and results audited. NRS's credibility will come from publishing weak results as well as strong ones.
An operator right is proven when an operator uses it under stress and the institution responds as promised. Everything before that is design evidence.
A future Tuesday is the real test
Imagine an operator in 2029 that has never attended an NRS meeting. Its registered contact is accurate, its fees are current and its network serves customers across several jurisdictions. The current provider announces a material service-term change and later places a broad hold on all resources after a dispute concerning one block.
Under a participation-centered model, the operator is told that the policy was openly discussed and that it could have contributed. Under a rights model, the operator invokes the signed schedule. It receives the evidence and authority for the hold, obtains emergency preservation for uncontested resources and asks an independent adjudicator to review proportionality.
The operator elects to port. The valid dispute follows the affected block. Authenticated history, current standing and dependent service state move through the recognized transition mechanism. The incumbent cannot veto the move merely because the operator challenged it. The receiving provider assumes duties at the transition point. The adjudicator's final decision can correct the state and allocate cost.
No applause is required. No majority must agree that this operator is sympathetic. The operator may ultimately lose the dispute. What it does not lose is the right to a bounded decision, continuity for uncontested operations and an effective correction if it wins.
That is the institutional product NRS should build. Meetings can improve it, operators can choose it and outside institutions can test it. The right itself lives in the contract, portable state and remedy.
Rights make participation more honest
The multistakeholder model often asks participation to carry too much. It is expected to supply expertise, inclusion, legitimacy, consent, accountability and remedy. No meeting form can do all of that.
When operators have an enforceable floor, participation can return to its proper function. Meetings can compare evidence and develop better policy without pretending that everyone present authorized everyone absent. Providers can defend their technical judgment without claiming that openness cures contractual imbalance. NRS can advocate reform without claiming sovereignty.
Contracts identify duties. Portable registration disciplines non-substitutable service. Independent remedy corrects error and restrains both operator and provider. These mechanisms are less photogenic than a plenary. They are more useful when real risk arrives.
The positive case for Number Resource Society is therefore institutional rather than theatrical. NRS can take the operator-centered principles it has stated publicly and turn them into a rights architecture that survives disagreement, absence and succession. It can show that openness is strongest when exit is safe, and that community is most credible when no institution is indispensable.
The standard should apply without exception. An operator need not attend to possess the right. A provider need not agree with the operator to respect it. NRS need not remain the provider for the right to survive. The system earns trust because the mechanism works when the relationship does not.
Sources and scope
The current system boundary is grounded in RFC 7020, the ICANN Bylaws, ICP-2 and current RIR governance reform. Contract and review analysis uses the current public ARIN RSA, RIPE NCC Standard Service Agreement, RIPE arbitration materials and APNIC Membership Agreement.
NRS is treated positively but within the status shown by its public charter, institutional description, membership terms and governance analysis, together with Lu Heng's number-resource portability proposal. These sources establish direction and stated commitments, not present recognition or service performance.
Technical continuity analysis uses RFC 6480, RFC 9286 and RFC 6811. The operator-rights agreement, portable-state design, independent-remedy model, transition stages and performance measures are prospective proposals. They do not claim that NRS currently operates an IANA-recognized registry, a live multi-provider portability network or a universal adjudicatory body as of 15 July 2026.