authorizing changes in the new registration database

[Michael O'Neill]

Hello!

During the design of ARIN's new registration database, ARIN staff has
identified some issues with respect to authorizing changes to the
database. We've outlined our concerns below and are requesting any
comments from the community.

In the new database schema, every network registration including
reassignment and reallocation registrations (i.e. SWIPs) will be
associated with an organization record that contains the name and
address of the organization holding the IP space or AS registration.

In the current database, the upstream organization is the only entity
with the authority to add/modify/delete reassigment information.

Building a more reliable, maintainable, and modular system, however,
requires a new division of authorization.  Under this separation of
maintenance responsibility, downstream customers organizations that
have reallocations or reassignments would be authorized to:

  * add/change/remove POCs associated with the downstream customer
  * add/change/remove a public comment about the downstream customer
  * change the mailing address of an downstream customer

but would not be authorized to:

  * return IP resources such as networks
  * update any network attributes including the network name, in-addr
      nameserver, comments, or further reassignment data, unless
      otherwise authorized as discussed below [1]

This raises these questions for comment:

Question 1 - Who should be authorized to create an organization record
             for a reallocation or reassignment?

Option A: The upstream ISP creates an organization record on behalf of
          the organization receiving a reallocation or reassignment.
Option B: The customer organization creates its own organization record.
Option C: Either the customer or the upstream ISP may create the 
          record. [2]

Question 2 - When should this organization record be created?

Option A: The record should be created before the reallocation or
          reassignment is made via a separate "Organization Template."
Option B: The record should be created at the same time that the 
          reallocation or reassignment is made via an expanded 
          "Reassignment Template" that includes the organization
          information. 
Option C: The Organization may either be created using the "Organization
          Template" [A] or via the "Reassignment Template" [B].


Question 3 - Should the customer organization record be permitted to
             have the POC of their upstream ISP or must the POC be
             from their own organization?

Option A: The POC is the upstream ISP. The upstream ISP
          would have control over reassignment data since the
          customer organization would not be able to update its
          own organization data. 

Option B: The customer organization must have their own POC. If they
          directly apply for address space in the future, ARIN will be
          able to identify how they have managed space in the
          past. ARIN can maintain a more accurate database and reduce
          duplicate responses to a whois query for a common name.

Option C: The customer organization may have their own POC, but the
          upstream ISP might alternately specify its own POC for the
          reallocation.

NOTES

[1] In January, there was discussion on ARIN's Database Working 
    Group mailing list regarding changing an Assigned network to 
    an Allocated network.  The result was that only the upstream 
    has this authority, and ARIN has been enforcing this since 
    that decision. We envision no change to this policy. Please
    see the mailing list archives for further details.
    http://www.arin.net/mailinglists/ppml/0152.html

[2] Before drafting the new database schema, the
    http://www.arin.net/mailinglists/dbwg/0110.html mailing list
    archives discussed these issues on a preliminary basis. Support
    was shown at the April PPM for Option C


Michael J. O'Neill
ARIN Engineering

==============================================================
email                              michaelo at arin.net
==============================================================