The Standards Expert as Accidental Legislator

Summary

• A technical decision becomes distributive when it determines who may obtain, retain, transfer, authenticate or contest access to a scarce or indispensable network capability. At that point engineering evidence remains necessary but is no longer sufficient authority.
• The correct denominator is not the number of experts in a room. It is the affected population for each consequence: resource holders, applicants, downstream networks, users, implementers and people exposed to security or disclosure risk.
• Institutions should separate four findings in consequential decisions: technical feasibility, operational impact, distributional choice and legal or contractual authority. The same person may contribute to each, but the record must not collapse them.
• A proportionate safeguard is a boundary review triggered by rights effects, followed by affected-party notice, competing option analysis, reasoned closure, appeal and post-implementation evidence. It preserves expert leadership without converting reputation into an unlimited mandate.

The boundary is crossed when a design choice allocates a right

A standards expert becomes an accidental legislator through a change in the entity of decision. The discussion may begin with packet formats, route validation, identifier uniqueness or registry data quality. It crosses a governance boundary when the selected answer determines which organisation may receive an address block, whether an existing holder can keep or transfer it, whose route will be treated as acceptable, what information a registrant must expose, or which party can challenge an administrative refusal.

The expert has not necessarily sought political power. Usually the opposite is true. Engineers are asked to solve a concrete coordination problem because they understand failure modes that generalists cannot see. Their answer may be careful, reversible and widely supported. Yet if implementation attaches material rights or burdens to the answer, technical competence has begun to perform work that resembles legislation: defining eligible classes, setting conditions, assigning costs and specifying remedies.

This is not an argument that Internet standards are statutes or that every protocol option requires a parliament. Voluntary implementation, open participation and distributed deployment make the analogy incomplete. It is a diagnostic. It asks whether the reasons offered match the kind of authority being exercised. “This mechanism converges safely” can support an engineering conclusion. It cannot alone support “this class must lose access,” “that class must disclose more,” or “only these account holders may appeal.”

The distinction protects experts as much as affected parties. Without it, engineers are blamed for distributive consequences that boards, contracts or policy communities quietly delegated to them. A clear boundary lets technical contributors state what the evidence establishes and forces the institution that owns the consequential choice to explain its authority.

Internet engineering deliberately privileges competence

The IETF is explicit about the value of engineering judgment. Its introduction describes a mission to produce high-quality technical and engineering documents that make the Internet work better. It emphasises technical competence, individual participation, rough consensus and real-world implementation. The guide to the standards process explains how an individual proposal can move through a working group, last call and IESG review before publication in the IETF stream.

That model has strong reasons. Interoperability cannot be negotiated by counting preferences while ignoring physics, deployed code and adversarial behaviour. A routing design that fails under scale does not become sound because a larger constituency likes it. A cryptographic construction does not become secure through geographic balance. Expertise, implementation and reproducible evidence properly carry unusual weight.

The early Internet Standards Process, published in 1992, described an international collaboration of autonomous networks relying on voluntary adherence to open protocols. It sought clear, open and objective procedures with discussion and implementation by independent parties. The modern process retains that combination of openness and technical testing.

But competence is domain-bounded. The IETF's strength is judging technical specifications within its mission. It does not follow that a person skilled in routing architecture has a representative mandate from every network or user affected by an allocation rule. Nor does protocol authorship make someone the proper authority to decide contractual remedies, fee incidence or the acceptable loss of an existing registration interest.

Institutional design should therefore preserve a strong presumption in favour of expert evidence on technical questions while refusing the silent extension of that presumption to every consequence downstream.

Standards, registry policy and corporate decision are different acts

Internet coordination often connects three decision systems. A standards body defines a protocol or operational practice. A regional community develops number-resource policy. A registry organisation implements that policy through services, contracts and internal controls. Similar people may appear in all three systems, and each may cite the others.

The acts are not interchangeable. An IETF document may define how a mechanism works and the conditions required for interoperability. A regional policy can determine eligibility, allocation size, transfer conditions or registration duties. A registry board can approve budgets, risk controls and organisational commitments. Staff can translate adopted policy into service procedures. Each step has a different source of authority and a different affected denominator.

APNIC's Policy Development Process illustrates the regional layer. Anyone interested in number-resource management may participate; chairs consider mailing-list, meeting and remote contributions; a show of hands can gauge opinion but is not a vote; objections should be examined and consensus passes through meeting, member and later comment stages before Executive Council endorsement. Technical evidence is central, but the process does more than technical review. It establishes who may propose, how objections travel and which institutional body endorses implementation.

RIPE's current policy process similarly provides an appeal route for process and consensus determinations. That safeguard would be unnecessary if correctness alone mechanically produced policy.

Problems arise when a document from one layer is treated as conclusive authority in another. “The standard requires it” may conceal optional implementation choices. “The community agreed” may conceal a narrow technical discussion. “The board approved it” may conceal that the board assessed corporate risk rather than resource-holder fairness. A defensible record names the act and does not let borrowed prestige substitute for the missing decision.

Scarcity turns architecture into distribution

Number resources expose the boundary sharply because uniqueness and scarcity are linked. Address space and Autonomous System Numbers are technical identifiers, but registry rules decide access to their recognised registration and operational use. A prefix length may be justified by routing practice while also determining how many organisations can qualify. A transfer rule may preserve registry accuracy while affecting the value and continuity of existing holdings. A reclamation procedure may protect stewardship while risking customer disruption.

The same is true of less obviously scarce capabilities. Trust anchors, certificate services, authenticated registry changes and authoritative directory entries can become essential to operation. A choice about who may submit or revoke an entity distributes control even if the underlying bits are unlimited. Rate limits, validation requirements and evidence thresholds allocate administrative capacity.

Scarcity can be physical, logical, institutional or practical. IPv4 scarcity is familiar. A unique namespace is logically exclusive. Review attention is institutionally scarce. The time available before a security response is practically scarce. Each form creates trade-offs among claimants.

Experts are indispensable for identifying the constraint. They can show whether route aggregation is threatened, whether a cryptographic transition is safe or whether a proposed exception can be implemented. The distributive question follows: given the constraint, which interests bear the burden and under what authority?

That second question cannot be answered by pretending the constraint disappears. Nor should it be answered by treating all preferences as equal to evidence. The correct approach is sequential. Establish the technical boundary with expert reasons. Then compare feasible options against publicly stated allocation principles, affected-party evidence, institutional authority and remedy. Technical infeasibility can remove an option; technical feasibility cannot select among all remaining social choices by itself.

The expert-room denominator proves almost nothing about mandate

A room containing twenty recognised specialists may possess more relevant knowledge than a survey of twenty thousand users. It still does not represent those users unless a separate authorisation chain exists. Expertise and representation answer different questions.

For a protocol defect, the important denominator may be independent implementations, deployment environments and attack models tested. For a number-resource eligibility rule, it may include current holders, rejected applicants, prospective entrants, networks served through national registries and downstream dependants. For a disclosure requirement, it includes people whose information will be exposed and those relying on the record. For a revocation mechanism, it includes resource holders, customers and counterpart networks exposed to route loss.

A participation report should therefore resist the easiest denominator: meeting attendance. It should first define the consequence. Then it should identify the population capable of experiencing that consequence and report how evidence entered from each materially different group. No claim of universal representation is required. Unknown and unreachable groups can be named.

This method also prevents large commercial actors from converting customer scale into votes. A transit provider serving millions may supply highly valuable deployment evidence; it does not automatically hold a mandate from every customer. A small operator may reveal a decisive edge case; its small size does not reduce the validity of the evidence. A civil-society contributor may identify a disclosure harm without operating a network.

The denominator calibrates uncertainty, not arithmetic power. It lets a chair say that the technical record is strong while evidence about small-network transition costs is thin, or that user exposure was identified but not directly tested. Such a statement is more credible than describing a technically accomplished room as “the Internet community” without qualification.

Individual participation does not create collective authorisation

The IETF's individual-entity tradition is a safeguard against corporate bloc voting. People contribute arguments rather than formally weighted employer positions. This can produce high-quality work across institutional boundaries and lets a technically compelling objection succeed without a large sponsor.

Individual participation also sets a limit. If entities act as individuals, their rough consensus cannot simultaneously be described as an electoral mandate from employers, countries or users. The process gains legitimacy from openness, expertise, review and adoption—not from a fictional constituency count.

That distinction becomes crucial when a technical output is used to justify resource policy. A contributor may understand deployment globally while representing no one. Another may bring authorised evidence from an operator but not speak for its customers. A working-group chair has procedural responsibility but no general power to decide who deserves a registry entitlement.

Institutions should celebrate individual technical contribution without inflating it. Records can distinguish the origin of evidence, relevant disclosed interests and any claimed organisational mandate. They should not infer that an affiliation owns a person's speech. Nor should they count several employees as several independent publics without showing common control.

The discipline is simple: describe what the process actually supplies. An open technical forum can supply tested specifications, documented objections and a reasoned rough-consensus judgment. It cannot supply an election that never occurred or customer consent that was never requested. When later institutions rely on the output, they should add the authorisation appropriate to their own decision rather than rewriting the standards process as a legislature.

Technical necessity is often narrower than the chosen rule

Governance disputes frequently turn on an overbroad claim of necessity. A security objective may be necessary, while one identity requirement is not. Registry accuracy may be necessary, while permanent publication of every field is not. Route validation may be valuable, while one deadline or sanction remains a policy choice. Address conservation may constrain allocation, while several fair allocation methods remain technically possible.

A boundary review should require a necessity map. First state the verified technical objective. Then list the minimum conditions without which the mechanism fails. Next identify design choices that remain open. Finally show which open choices create differential costs or rights effects.

This map prevents authority laundering. If experts agree that a cryptographic system requires verified control of a resource, the record should not silently turn that finding into agreement on the legal identity documents, publication practice or appeal deadline. Those are additional choices. Experts can advise on fraud risk and operational load, but the institution must explain proportionality and remedy.

Alternatives matter because technically literate communities can converge early on a familiar implementation. The first workable design acquires momentum, code and vocabulary. Later distributional objections then appear to challenge “the technology” rather than one configuration. Publishing at least two feasible options, including a no-change or staged option where credible, makes residual choice visible.

When only one feasible option exists, that fact should be demonstrated rather than asserted. The institution may still need to mitigate concentrated harm, compensate transition work, grandfather existing reliance or provide a review. Necessity can justify action; it does not erase the people who bear it.

Five tests identify accidental legislation

Not every standards decision needs an elaborate public-law process. A short screen can identify when additional governance is required.

The first test is entitlement. Does the decision create, condition, suspend, transfer or terminate access to a registry-recognised capability? The second is burden. Does it impose material cost, disclosure, liability, migration or service risk on a class that did not select the rule? The third is exclusivity. Does choosing one option prevent another claimant from receiving a scarce or unique capability? The fourth is remedy. Does the decision determine who can complain, appeal or obtain correction? The fifth is dependency.

Can an upstream decision predictably disrupt users or networks that have no direct relationship with the deciding institution?

A “yes” does not invalidate the proposal. It triggers separation of findings. Technical review continues. In parallel, the responsible policy or corporate body identifies authority, affected populations, alternatives, safeguards and review.

The screen should be completed when work is chartered and repeated before final adoption because consequences emerge during design. It can be one page. The author identifies expected effects; chairs confirm scope; staff add implementation exposure; affected parties can correct omissions.

False positives are preferable to silent boundary crossing, but proportionality matters. A low-cost optional extension may need only a note. A rule capable of deregistering resources or changing recognised route authority needs a much stronger record. The trigger determines depth, not outcome.

This approach avoids the impossible task of classifying entire organisations as technical or political. The same IETF group can make a purely technical encoding choice in one document and a consequential operational recommendation in another. The same registry community can decide a housekeeping definition and a major eligibility rule. Governance follows the act.

Roles should be separated even when people overlap

Small specialist communities cannot staff entirely separate expert, policy and oversight classes. The same engineer may author a specification, participate in a regional policy group and advise a board. Overlap preserves memory and can expose inconsistencies early. The safeguard is not exclusion; it is role clarity.

A consequential record should name four roles. Technical assessors establish feasibility, failure modes and evidence quality. Operational assessors examine implementation, cost and service continuity. Policy entities evaluate distribution among feasible options. The accountable authority adopts, rejects or returns the result and owns the remedy.

One person may speak in several roles, but each intervention should identify the active capacity. A chair who helped design a mechanism can explain it, then hand consensus assessment to an unconflicted co-chair. Staff who authored an impact analysis can answer factual questions without presenting corporate feasibility as community agreement. A board adviser can disclose prior authorship before oversight review.

Recusal should follow power, not mere knowledge. Authors should not be silenced from technical explanation. They should step away from final determinations where personal, organisational or reputational interests create a material conflict. Independent review is especially important when the decision validates a design championed by the reviewer.

Time-aware declarations matter. Affiliations and offices change between drafting and adoption. The record should preserve what was disclosed at the time rather than dynamically applying a current biography to an old decision. The purpose is to interpret authority, not to create permanent personal dossiers.

The affected population needs an evidence route, not a veto

Recognising distributional effects does not mean every affected person receives a vote. That would be impossible and could allow incumbent numbers to block necessary security or interoperability work. The requirement is a credible route for relevant evidence and objections.

Notice should describe the consequence in ordinary operational terms. A small ISP needs to know which systems, customer commitments and deadlines may change, not only the identifier of a technical document. A user group needs to know what data or service risk changes, not the details of packet encoding. Translations and asynchronous channels should appear before positions harden.

Targeted outreach should sample materially different conditions: large and small networks, direct and indirect resource relationships, mature and emerging markets, implementers, security responders and downstream users. Sampling is not representation. The report should show invitations, responses, unknowns and reasons for non-response without generalising beyond the evidence.

Objections should be coded by claim and disposition. A technically invalid objection can be answered with evidence. A distributional objection may require mitigation or explicit acceptance of a burden. An objection outside institutional authority should be referred rather than ignored. Repetition need not consume unlimited meeting time if the underlying issue remains visible.

No affected group should receive a categorical veto merely by claiming impact. A reasoned process can proceed despite opposition, especially where security or global interoperability requires action. Its legitimacy comes from confronting the strongest evidence, choosing within authority and preserving review—not from unanimity.

Appeals reveal what kind of authority was exercised

Appeal design is a useful test of institutional honesty. If the only permitted appeal asks whether the expert made a technical mistake, the institution is treating every consequence as engineering. If a claimant can also challenge process, authority, proportionality or contractual application, the institution recognises that more than technical truth is at stake.

RFC 2026 includes conflict resolution and appeals for standards disputes, reflecting commitments to openness and fairness. RIPE's policy process allows anyone to appeal handling or a consensus determination through a defined route, with recusals and final review. These mechanisms protect process; they do not automatically provide a remedy for every downstream contractual effect.

Registry service disputes require their own path. The RIPE NCC arbitration framework covers specified disputes relating to number-resource registration services and identifies who may bring them. APNIC's transparency page points members to a management escalation for operational decisions. The identity and contractual position of the appellant matter.

A complete decision map should therefore say which instrument can be challenged, by whom, on what ground and with what interim protection. A standards appeal may change technical text. A policy appeal may reopen consensus. A service appeal may correct application to a holder. A downstream user harmed by an upstream interruption may still lack direct standing.

No single forum needs to hear everything. But gaps should be visible before adoption. If a rule can impose material downstream harm and no body can consider it, the accountable authority should create a limited review channel or explain why another remedy is adequate.

Best Current Practice documents require special care

The IETF publishes more than protocol standards. Best Current Practice documents can describe process, operations and recommended behaviour. Their influence can be substantial because procurement, security teams, regulators and registries may treat an authoritative recommendation as a baseline.

RFC 6852 describes a modern standards paradigm grounded in due process, broad consensus, transparency, balance, openness and technical merit. Those principles offer a useful safeguard, particularly the commitment that no single interest should dominate. Yet a balanced standards process still cannot know every later use of its output.

Authors should mark the normative boundary. Which recommendations are necessary for interoperability or security? Which are prudent defaults? Which depend on local law, contract, risk appetite or distributional choice? What evidence would justify deviation? This language helps downstream institutions avoid turning guidance into an unexplained command.

Registries and regulators should reciprocate. If they make a recommendation mandatory, they should own that adoption. The public record should not say “the IETF decided” where the IETF published optional guidance and a later body selected enforcement. It should identify any modifications, affected parties and remedy.

Periodic review is essential because operational advice can harden after conditions change. A recommendation written for one threat environment may impose unnecessary costs later. Deployment evidence should be able to reopen it without requiring critics to challenge the standing of its authors.

This discipline protects the authority of Best Current Practice. Its value comes from candid scope and strong reasoning, not from allowing every adopter to borrow the IETF name for choices the document did not make.

Board endorsement must add judgment rather than ceremony

Registry boards often sit at the final junction between community output and implementation. Their proper role is neither to re-engineer technical work nor to rubber-stamp every consensus label. They should verify authority, process integrity, organisational feasibility and treatment of material risk.

An endorsement paper should separate the findings. It can state that technical feasibility was assessed through specified evidence; that the policy community reached its determination under a named process; that staff identified cost and implementation conditions; and that the board considered contractual, financial and rights effects within its remit.

Where the board departs from community advice, it should explain the power used and provide a return path. Where it endorses despite thin affected-party evidence, it should require staged implementation or early review. Where implementation adds a new burden not present in the adopted text, that addition should return for scrutiny rather than arriving as an administrative detail.

Board composition does not solve the problem by itself. A geographically or professionally diverse board can still receive a collapsed record. Conversely, a small board can make a defensible decision if evidence, conflicts, authority and reasons are public. The key is whether endorsement adds accountable judgment.

Boards should also protect technical contributors from retrospective blame. Minutes can identify which consequences were foreseeable at adoption, which were mitigated and which emerged later. Institutional ownership prevents a culture in which experts carry public responsibility while directors retain formal power but claim they merely followed the community.

Implementation can create a second distributive decision

The adopted text rarely determines every operational detail. Forms, identity checks, cut-off dates, grace periods, software defaults, support capacity and evidence thresholds can decide who succeeds in practice. Staff may need discretion because no policy can anticipate every case.

That discretion becomes accidental legislation when an implementation choice changes the eligible class or burden materially. A documentary requirement may be easy for established companies and impossible for community networks. A migration window may be adequate for large teams and dangerous for small operators. An automated validation rule may reject legitimate but unusual structures.

Before launch, the institution should compare implementation against the boundary review. Any new entitlement, burden, exclusivity, remedy or dependency effect returns to the accountable policy owner. Minor choices can be logged; major ones need notice and reasons.

Operational metrics should follow distribution as well as delivery. Report application outcomes by relevant organisation type and region at safe aggregation, reasons for rejection, support requests, processing time, exceptions, appeals, service incidents and downstream effects. Do not publish only the percentage completed on schedule.

Staff should have a protected escalation route when literal implementation appears unsafe or inequitable. Raising a concern should not require them to declare policy failure. The authority can approve a temporary exception, clarify text or reopen the question.

This is where many rights effects become visible for the first time. Treating launch as a purely technical phase denies the evidence that could improve the rule. Implementation is part of governance because it converts abstract conditions into lived access.

Metrics should test authority drift

Institutions can monitor the expert-legislator boundary without assigning a legitimacy score. A yearly report can count consequential proposals screened, effects identified, affected groups contacted, feasible alternatives compared, material implementation additions, appeals and post-launch corrections.

It should also trace citation chains. How often did a registry rule rely on an IETF document? Did the cited text actually require the rule or merely describe an option? How often did corporate documents invoke “community consensus” without linking the decision record? How many board endorsements distinguished technical, policy and corporate findings?

Participation measures need aligned denominators. For each consequence, report the relevant affected classes and the evidence received. Unknown rates should remain visible. Meeting attendance can be included as access evidence but not converted into mandate.

Outcome measures should be cautious. A low appeal count may mean satisfaction, lack of standing, cost or ignorance. Fast implementation may reflect good preparation or suppressed exceptions. Broad adoption may reflect technical merit, market power or contractual compulsion. Pair numbers with qualitative review.

An independent sample audit can examine several high-impact decisions each year. It need not retry the substance. It asks whether authority was correctly attributed, residual choices were visible, conflicts were managed and remedies matched foreseeable harm. Findings should lead to process repair rather than personal accusation.

The most useful indicator is correction without crisis. An institution that can identify boundary drift, reopen a narrow issue and preserve service demonstrates strength. One that insists every choice was “technical” until litigation or outage forces change has confused expert confidence with accountable authority.

A practical decision record can remain compact

The safeguards need not bury volunteer communities in paperwork. A high-impact decision can be accompanied by a concise public record with nine elements.

First, define the technical objective and evidence. Second, state which conditions are necessary and which choices remain open. Third, identify entitlement, burden, exclusivity, remedy and dependency effects. Fourth, define affected populations and note evidence gaps. Fifth, compare feasible options and distributional consequences. Sixth, disclose the active roles and material conflicts of decisive contributors. Seventh, name the adopting authority and the instrument that gives it power. Eighth, specify appeal, interim protection and review. Ninth, publish implementation measures and a date for reassessment.

Each element can link to deeper material. The summary should be understandable by an operator or user who did not attend. Technical appendices can retain precision. Sensitive security evidence can be reviewed under protected handling with a public description of what it supports and why detail is withheld.

Low-impact work can record that the screen found no material rights effect. Repeated classes of decision can use standing templates only for structure, not conclusions. The burden should scale with consequence and uncertainty.

The record also improves institutional memory. Years later, successors can see why a choice was necessary, which alternatives were rejected and what evidence would justify change. That is more useful than inherited folklore that “the experts decided it.”

Most importantly, the record lets expertise remain authoritative where it should. Engineers need not dilute clear technical findings with performative balance. They can state the constraint strongly while the accountable body owns the choice among feasible distributions.

Procurement and compliance can expand a recommendation silently

The most consequential use of a technical document may occur outside the forum that wrote it. A public buyer includes conformance in a tender. A regulator treats a recommended practice as a safe harbour. An insurer asks whether a network followed it. A registry makes it a service condition. Vendors then implement the requirement as a default because customers expect certification.

None of these later choices necessarily appears in the original consensus record. Voluntary guidance can become practically mandatory through accumulated dependencies. Small networks may face a choice between expensive compliance and losing customers, even though no institution formally prohibited the alternative.

The adopting body should publish a translation note. It identifies the technical text cited, whether the provision is mandatory or recommended in that text, what local obligation is being added, who is affected and what exceptions or review exist. If several versions are possible, the note explains why one was selected. This prevents “standards compliance” from hiding the buyer's or regulator's own distributive choice.

Standards authors can assist by using precise requirement language and documenting extensibility, transition and known deployment limits. They cannot anticipate every procurement context. Downstream bodies remain responsible for proportionality, competition and access effects.

Metrics can detect silent expansion. Survey high-impact requirements and trace how many derive from optional recommendations, how many provide alternative compliance and how many include a review date. Small-operator evidence should be sought because fixed compliance costs often concentrate there.

This downstream analysis also disciplines claims about market adoption. Widespread conformance may demonstrate technical value, but it may also reflect purchasing power or regulatory incorporation. Adoption evidence should not be returned to the standards forum as proof that every implementer freely preferred the design.

The chain remains legitimate when each actor owns its step: experts state the technical case; adopters state the obligation; affected parties can challenge the adoption within the proper forum. It becomes accidental legislation when all later actors point backward and no one accepts responsibility for compulsion.

Sunset and reversibility reduce constitutional weight

Some consequential choices must be made before the affected evidence is complete. A security incident may demand a new validation rule; an exhausted resource pool may require an interim allocation method. Reversibility can make expert-led action safer without pretending uncertainty has disappeared.

The adopting body should define duration, success measures, rollback conditions and protected reliance. A pilot can limit geography, resource volume or entity class. A temporary rule can expire unless renewed through fuller review. A staged transition can preserve the old mechanism for parties unable to migrate immediately.

Reversibility is not always possible. Once a unique resource is transferred, disclosure published or market investment induced, reversal can create new harm. The record should identify these ratchets before action and apply stronger authority at the outset.

Sunset review needs the original denominator. Did the rule reach the affected classes predicted? Which applicants succeeded or failed? Were small networks disproportionately burdened? Did technical risk fall? Were exceptions used as expected? Unknown outcomes should count against confident permanence.

Temporary status should not become permanent by administrative inertia. Renewal is a new decision with current evidence and conflicts. Conversely, a successful temporary measure should not be rejected merely because experts initiated it; the question is whether later authority and review caught up with the consequences.

Time limits create a bridge between urgent competence and durable legitimacy. They let engineers respond to real constraints while reserving permanent distribution for an accountable decision after operation supplies evidence.

The goal is bounded authority, not anti-expertise

Internet governance would fail without people who understand protocols, routing, registries and deployed systems. The response to accidental legislation cannot be to subordinate engineering to popularity or to reserve every decision for governments. Distributed networks need specialist institutions capable of moving faster than formal law and learning from operation.

Bounded authority is the stronger model. Technical competence earns deference on technical evidence. Open processes expose errors. Implementation tests claims. Policy communities decide number-resource rules under stated procedures. Boards own corporate adoption. Contracts identify service relationships. Appeals and review correct mistakes. Each source of authority remains visible.

This arrangement also makes participation more honest. Users are not said to have consented because experts acted for the global Internet. Operators are not said to have authorised a rule because some engineers attended. Experts are not accused of capture because they supplied indispensable judgment. The record can hold all three truths at once: the technical case may be compelling, the affected evidence incomplete and the decision still justified with safeguards.

The decisive question is not whether a standards expert has influence. Influence is inevitable and often deserved. It is whether the institution notices when that influence begins allocating rights, burdens and remedies—and adds the authority that engineering judgment cannot supply alone.

When it does, the expert is no longer an accidental legislator. The expert remains an expert, and the institution finally accepts responsibility for governing.