Mandate Laundering and Governance Drift in the IPv4 Market

The IPv4 market has changed substantially since the Regional Internet Registry system developed in an era when allocation of available address space was a central part of Internet number-resource administration.

Today, IPv4 resources also move through transfers, leasing arrangements, corporate restructuring, cloud infrastructure and globally distributed networks.

This creates an important governance question:

How should the authority of an Internet number registry remain aligned with the coordination functions that independently operated networks actually require?

Lu Heng uses the term mandate laundering to describe one potential form of institutional drift: a narrow coordination function gradually being presented as a broader source of commercial, territorial or operational authority.

The term is a governance framework proposed by Lu Heng. It is not a standard technical term or universally accepted description of the Regional Internet Registry system.

A related concept, governance drift, describes what can happen when the scope or interpretation of governance mechanisms gradually extends beyond the functions originally required for technical coordination.

For IPv4 operators, the practical issue is not only institutional theory.

It is whether commercial rights, registry state, routing authorisation and operational reality remain sufficiently aligned for legitimate networks to continue operating through market, policy and institutional change.

Mandate Laundering and Governance Drift: Quick Answer

In this article, mandate laundering refers to a process in which a limited administrative or technical coordination role is treated as supporting a broader form of compulsory authority than the underlying function necessarily requires.

Governance drift refers to the gradual expansion, reinterpretation or changing practical effect of policies and institutional practices.

Neither concept means that Internet number registries are unnecessary.

Regional Internet Registries perform important functions involving:

• Internet number-resource registration;
• resource uniqueness;
• allocation and assignment processes;
• eligible transfers and organisational changes;
• registration data and contactability;
• RPKI-related services;
• reverse DNS; and
• coordination across independently operated networks.

The governance question is where compulsory common coordination should end and where commercial or operational decision-making should remain with network operators and other competent parties.

Coordination is necessary. Coordination should not automatically become authority over every commercial or operational decision involving an IPv4 resource.

For background on the current Internet number-resource system, see IANA – Number Resources and NRO – Regional Internet Registries .

Why the IPv4 Market Makes This Question More Important

IPv4 scarcity changed the economic environment around Internet number resources.

IPv4 resources now participate in a mature commercial environment involving:

• IPv4 transfers;
• IPv4 leasing;
• corporate mergers and acquisitions;
• cloud infrastructure;
• provider-independent addressing;
• BYOIP deployment;
• network migration;
• secondary-market transactions; and
• long-term business-continuity planning.

These developments do not make registry coordination obsolete.

They make it more important to distinguish the different forms of authority surrounding an IPv4 resource.

Four Layers Should Not Be Collapsed Into One

A useful way to analyse IPv4 governance is to separate four connected but distinct layers:

legal and commercial rights → registry state → routing authorisation → operational use

Problems emerge when authority in one layer is assumed to determine every other layer.

A registry record is not automatically a property judgment.

A commercial agreement does not itself update RPKI.

A ROA does not determine every commercial right.

A BGP announcement does not establish legal title.

Each layer performs a different function. Good governance keeps them coherent without collapsing them into one source of control.

What Is the Mandate of Internet Number Coordination?

Internet number-resource coordination exists because independently operated networks need globally unique identifiers.

IP addresses and Autonomous System Numbers need sufficient coordination for networks to interoperate across the global Internet.

Registries therefore perform genuine and necessary common functions.

These can include:

• protecting uniqueness;
• maintaining accurate registry state;
• providing reliable registration information;
• supporting contactability;
• recording legitimate transfers and organisational changes;
• supporting routing-security information;
• supporting reverse DNS; and
• maintaining continuity of important coordination services.

The Number Resource Organization describes the global RIR system as consisting of five Regional Internet Registries that administer, manage, distribute and register Internet number resources within their respective service regions.

The policy question is not whether those functions are necessary.

It is how far compulsory authority should extend beyond them.

What Is Mandate Laundering?

Lu Heng uses mandate laundering to describe a potential mechanism through which institutional authority expands.

In this framework, mandate laundering can occur when:

1. a limited coordination function is established;
2. institutional and participatory processes develop around that function;
3. those processes are treated as a broader source of legitimacy;
4. that broader legitimacy is then used to justify compulsory authority outside the original technical requirement.

The concern is not that registries maintain policies.

Predictable administration requires policies and procedures.

Nor is the existence of an open policy-development process itself evidence of mandate laundering.

The question is whether participation in a registry policy process is treated as sufficient justification for authority over questions that may primarily concern:

• commercial arrangements;
• market structure;
• geographic business decisions;
• customer relationships;
• provider selection; or
• network operation.

Lu Heng develops this argument further in Mandate Laundering: From RIR Fantasy to Transition Architecture .

Mandate Laundering Is Not the Same as IPv4 Leasing

Mandate laundering should not be defined as the existence of leasing, brokering, reselling or other commercial delegation.

These are different concepts.

IPv4 leasing is a commercial and operational arrangement.

A broker may connect buyers, sellers, lessors or lessees.

A reseller may provide a customer-facing service.

A resource holder may allow another organisation to use address space under a contractual arrangement.

None of those arrangements automatically represents governance drift.

The relevant coordination questions are instead:

• Is the underlying resource relationship identifiable?
• Are relevant registry records accurate?
• Are responsible parties contactable?
• Are commercial responsibilities clear?
• Can routing authorisation be maintained correctly?
• Are duplicate or fraudulent claims avoided?
• Can legitimate operational delegation be represented accurately?
• Can continuity be preserved when a relationship changes?

Commercial delegation is not mandate laundering. Institutional mandate expansion is the issue being analysed.

What Is Governance Drift?

Governance drift occurs when the scope, interpretation or practical effect of a governance system changes over time.

This does not necessarily happen through one dramatic policy decision.

It can occur incrementally through:

• new policies;
• staff interpretation;
• contractual terms;
• implementation procedures;
• audit practices;
• dispute processes;
• precedent; and
• changing market conditions.

An institution focused on technical registration may therefore gradually become involved in questions concerning:

• commercial structure;
• preferred business models;
• regional movement of resources;
• customer geography;
• resource-utilisation expectations;
• leasing arrangements;
• economic purpose; or
• other questions beyond basic number-resource coordination.

Some broader policies may have legitimate objectives.

The relevant question is whether compulsory authority is clearly grounded, proportionate and necessary for the coordination function being protected.

Written Policy and Operational Effect Are Not Always the Same

Governance should be evaluated by both written rules and real-world implementation.

A useful sequence is:

written policy → administrative interpretation → registry state → operational consequence

Two policies with similar language can have very different effects depending on how they are interpreted and enforced.

This makes transparency and auditability particularly important where administrative decisions can affect running networks.

Registry Recognition Matters, but It Is Not the Only Source of Legitimacy

Registry recognition is an important administrative fact.

It can affect:

• resource records;
• transfer processing;
• organisation information;
• RPKI-related services;
• reverse DNS;
• contactability; and
• other registry-supported functions.

But broader questions of legitimacy may also involve:

• contractual rights;
• applicable law;
• corporate authority;
• historical resource relationships;
• valid operational delegation;
• routing authorisation; and
• actual network operation.

Registry recognition is an important coordination fact. It should not automatically become the complete definition of legal, commercial or operational legitimacy.

A Registry Record Should Describe an Important Coordination State

Registry systems work best when they accurately reflect relevant and verifiable changes in Internet number-resource relationships.

These changes can involve:

• transfers;
• corporate succession;
• mergers and acquisitions;
• operational delegation;
• leasing relationships;
• routing relationships;
• security assertions; and
• administrative contacts.

A changing IPv4 market should therefore encourage better registry accuracy, not force operational reality into categories that no longer describe how networks actually use resources.

A registry record describes an important coordination state. It should not be mistaken for the source of every underlying right.

Why IPv4 Leasing Tests Governance Boundaries

IPv4 leasing is relevant because it can separate roles that might otherwise belong to the same organisation.

In a leasing relationship:

• one organisation may carry the upstream resource relationship;
• another may provide a commercial service;
• the customer may operate the prefix;
• the customer's ASN may originate the route;
• RPKI and IRR information may need to reflect that use; and
• third-party systems may eventually depend on the resulting network identity.

This does not automatically undermine Internet coordination.

The relevant test is whether the arrangement preserves:

• uniqueness;
• accurate relevant records;
• contactability;
• routing integrity;
• clear responsibility;
• fraud resistance; and
• operational continuity.

For an overview of different IPv4 leasing models, see IP Leasing: How IPv4 Leasing Works, Models, Costs & Benefits .

Multiple Intermediaries Are Not Automatically a Governance Failure

Brokers, marketplaces and resellers can perform useful functions in the IPv4 market.

They may provide:

• market discovery;
• transaction matching;
• commercial execution;
• customer support;
• regional business relationships; and
• technical services.

Additional parties can increase operational complexity, but complexity and illegitimacy are different concepts.

A multi-party structure can work effectively when:

• responsibilities are visible;
• contracts are clear;
• the underlying resource relationship is understood;
• routing support is available;
• continuity obligations are defined; and
• each dependency provides a useful function.

The problem is not intermediation itself. The problem is dependency without accountability.

For a deeper comparison, read IPv4 Broker vs First-Party IP Leasing Provider: What's the Difference? .

Running-Code Primacy: A Proposed Boundary for Common Rules

Lu Heng proposes a related framework called Running-Code Primacy.

Running-Code Primacy is a governance proposal, not a universal Internet standard or existing global policy.

Its central question is:

Does this compulsory rule protect something independently operated networks actually require in order to interoperate safely?

Under this framework, common rules have a stronger justification when they protect functions such as:

• globally unique identifiers;
• accurate registry state;
• contactability;
• fraud resistance;
• routing-security information;
• legible changes in resource relationships; and
• operational continuity.

Rules primarily aimed at regulating:

• market pricing;
• commercial morality;
• preferred business structures;
• customer geography;
• regional capital retention; or
• other non-technical commercial decisions

may require a different justification if they are to become compulsory.

When Governance Rules Become Operational Risk

Governance becomes an infrastructure issue when administrative decisions can materially affect a running network.

Relevant dependencies can include:

• registry records;
• transfer eligibility;
• RPKI authority;
• reverse DNS;
• account administration;
• recognition of operational delegation; and
• dispute-related changes.

The greater the operational consequence of institutional authority, the more important safeguards become.

These can include:

• clear scope;
• published rules;
• transparent procedures;
• appropriate due process;
• auditable decisions;
• proportionality;
• review mechanisms where appropriate; and
• continuity safeguards.

Authority and Accountability Should Remain Proportionate

A useful governance principle is that the scope of institutional authority should remain proportionate to the function being performed.

As an administrative decision acquires greater economic or operational consequences, questions of accountability become more important.

This does not mean a registry should be responsible for every downstream network problem.

It does mean that significant authority should generally be accompanied by:

• clear limits;
• predictable rules;
• auditability;
• appropriate review;
• proportionality; and
• attention to continuity consequences.

Governance Drift and Enforcement Creep

Registries need mechanisms to maintain the integrity of their records and respond to legitimate fraud, security or administrative concerns.

Enforcement creep becomes a risk when a mechanism created for one limited coordination function gradually becomes a tool for controlling unrelated behaviour.

For example, maintaining an accurate abuse contact can serve a legitimate operational purpose.

A separate question is whether failure in a contact-management process should automatically produce consequences for a running production network.

The more serious the potential consequence, the stronger the case for:

• clear authority;
• proportionality;
• due process;
• review mechanisms; and
• continuity safeguards.

Administrative Disputes Should Not Automatically Become Network Outages

Governance systems also need to distinguish an unresolved administrative dispute from a running network.

A dispute may involve:

• contractual rights;
• corporate authority;
• registry information;
• transfer eligibility;
• fraud allegations;
• resource status; or
• legal proceedings.

These questions may require investigation or adjudication.

But where a legitimate production network is already operating, continuity consequences should also be considered.

Where appropriate, preserving the last verified state while a dispute is resolved can reduce unnecessary disruption without prejudging the final outcome.

This does not prevent action against fraud or compliance with valid legal authority.

It distinguishes dispute resolution from unnecessary operational disruption.

For more on this issue, read What Happens When IPv4 Resources Are Recalled or Disputed? .

Registry Stability Is Not the Same as Network Stability

Registry continuity is important.

Network operators depend on reliable access to functions such as:

• registration information;
• RPKI;
• reverse DNS;
• transfer records;
• resource contacts; and
• other coordination services.

But preserving an institution and preserving a function are not necessarily the same thing.

The purpose of registry continuity is ultimately to support the networks that depend on registry functions.

Registry stability matters because registry functions matter. The final operational objective is continuity of the networks and services that depend on them.

A resilient model should therefore consider whether important registry functions are:

• auditable;
• recoverable;
• exportable where appropriate;
• replicable where appropriate;
• portable; and
• capable of continuity through institutional disruption.

Registry Region Is an Administrative Relationship, Not Geographic Ownership

Regional Internet Registries operate within defined service regions.

Those regions are important for organising registry services, membership and policy processes.

But the existence of a service region should not automatically be interpreted as geographic ownership of the number resources associated with that registry.

Registry region alone does not determine:

• where a prefix may be routed;
• where an operator's customers must be located;
• where services using the prefix must operate;
• where the resource has commercial value; or
• every legal right associated with the resource.

A registry region describes an administrative coordination relationship. It should not automatically be converted into geographic ownership.

Portability Is an Important Test of Governance Scope

Public IPv4 addresses can become embedded in long-term network identity.

An address may appear in:

• customer allowlists;
• APIs;
• firewalls;
• VPNs;
• banking integrations;
• payment systems;
• security platforms;
• partner networks; and
• compliance documentation.

Once this happens, forced renumbering can become a business-continuity event.

Portability therefore provides a useful test:

Is a restriction on resource mobility necessary to preserve uniqueness, security or interoperability, or does it create avoidable provider or institutional lock-in?

Portability is not unlimited.

Technical feasibility, routing scale, contracts, security and applicable processes still matter.

But where continuity can be preserved without compromising uniqueness or routing integrity, reducing unnecessary lock-in can strengthen operator independence.

Leasing Should Be Represented Accurately Rather Than Ignored

IPv4 leasing is part of the operational reality of today's Internet.

A registry system that cannot represent legitimate operational delegation may have a less complete picture of how resources are actually being used.

Where useful and appropriate, coordination systems can distinguish:

• the recognised resource relationship;
• the operational user;
• relevant routing authority;
• abuse contacts;
• technical contacts;
• security assertions; and
• time-limited delegation.

The objective is not to turn every commercial contract into public registry data.

It is to ensure that coordination systems can accurately represent the information needed for operational reliability.

Better visibility into legitimate operational delegation can improve coordination. Pretending operational delegation does not exist can reduce accuracy.

What a More Resilient IPv4 Governance Model Would Prioritise

A more resilient number-resource system does not require eliminating Regional Internet Registries.

It requires clearer boundaries between necessary common functions and decisions that can safely remain distributed.

Useful principles include:

1. Protect uniqueness. Prevent conflicting number-resource claims.
2. Maintain accurate registry state. Registry data should reflect relevant and verifiable administrative reality.
3. Preserve contactability. Responsible operational parties should remain reachable.
4. Recognise legitimate operational delegation. Leasing and customer use should not become invisible merely because they differ from historical allocation models.
5. Keep registry administration distinct from unnecessary enforcement. Authority should remain proportionate to the technical function being protected.
6. Preserve routing-security integrity. RPKI and related security assertions should remain accurate and usable.
7. Support portability where practical. Avoid unnecessary infrastructure or institutional lock-in.
8. Preserve continuity during disputes. Avoid unnecessary disruption to legitimate running networks.
9. Make critical coordination functions resilient. Important registry capabilities should be auditable and recoverable.

What IPv4 Buyers, Sellers and Lessees Should Watch

Enterprises do not need to resolve every Internet-governance debate before using the IPv4 market.

They should understand where important dependencies sit.

How This Relates to LARUS IPv4 Services

For LARUS customers, the practical objective is not to centralise governance authority around the service provider.

The objective is to make responsibility clearer.

A useful separation is:

Customer

→ controls its network, BGP policy, applications and infrastructure

IPv4 service provider

→ carries defined upstream commercial and registry-facing responsibilities associated with delivering the service

Registry layer

→ provides relevant number-resource coordination functions

The value of a first-party IPv4 service is therefore not that every layer becomes controlled by one organisation.

It is that unnecessary dependency can be reduced and service accountability can become easier to identify.

Clear accountability is more useful than unnecessary concentration of control.

Organisations where long-term public network identity matters can learn more about LARUS IPv4 Leasing Continuity Assurance .

Mandate Laundering vs Governance Drift

Frequently Asked Questions

What is mandate laundering in IPv4 governance?

Mandate laundering is a governance concept proposed by Lu Heng to describe how a limited coordination role can be presented through institutional, policy, regional or community legitimacy as supporting broader compulsory authority.

It is an analytical framework, not a standard Internet-industry term.

Is IPv4 leasing a form of mandate laundering?

No. IPv4 leasing is a commercial and operational arrangement. Leasing becomes relevant to governance when coordination systems need to represent legitimate operational delegation while preserving uniqueness, accurate records, contactability, routing security and continuity.

Are IPv4 brokers an example of mandate laundering?

No. Brokers are commercial intermediaries. They may introduce additional dependencies, but commercial intermediation should not be confused with institutional mandate expansion.

What is governance drift?

Governance drift describes the gradual expansion or reinterpretation of policies, institutional practices or authority beyond an earlier scope. Whether such expansion is appropriate should be evaluated against the function the rule is intended to protect.

Does registry recognition determine whether IPv4 use is legitimate?

Registry recognition is an important administrative and coordination fact. Legal rights, commercial rights, routing authorisation and operational use remain separate layers that may require separate analysis.

Are Regional Internet Registries unnecessary?

No. RIRs perform important Internet number-resource management, registration and coordination functions.

The governance question is how broad compulsory authority needs to be in order to preserve uniqueness, accurate records, security, interoperability and continuity.

What is Running-Code Primacy?

Running-Code Primacy is a governance framework proposed by Lu Heng. It argues that compulsory common rules should focus on functions independently operated networks genuinely require for interoperability, such as uniqueness, accurate coordination data, routing-adjacent security, fraud resistance and continuity.

Does an RIR service region determine where IPv4 can be used?

Not by itself. A service region describes an administrative relationship with a registry. It does not automatically determine where a prefix can be routed or where customers using that prefix must be located.

Should registries recognise IPv4 leasing?

Registry systems benefit from accurately representing the operational information needed for coordination.

Where leasing or delegation affects relevant contacts, routing relationships or responsibility, mechanisms that improve visibility can strengthen registry accuracy.

What is enforcement creep?

Enforcement creep describes the risk that mechanisms created for a limited coordination purpose are gradually used to regulate broader behaviour unrelated to that original function.

What is the main operational risk of governance drift?

Risk increases when organisations cannot clearly determine which rules affect their commercial rights, registry state, routing authorisation or continued network operation.

How can enterprises reduce IPv4 governance risk?

Enterprises should understand their contractual rights, verify registry state, identify upstream dependencies, know who can manage RPKI and IRR, preserve relevant documentation and build continuity plans before the same IPv4 identity becomes difficult to replace.

Conclusion

Mandate laundering and governance drift are useful concepts only when they help clarify where authority should sit.

They should not be used to suggest that registries, brokers, leasing providers or commercial markets are inherently illegitimate.

Internet number registries perform necessary coordination functions.

IPv4 markets perform legitimate commercial functions.

Network operators perform operational functions.

Contracts and legal systems address other forms of rights and authority.

A resilient Internet should keep these roles sufficiently aligned without treating one layer as the source of every other form of control.

legal and commercial rights + registry state + routing authorisation + operational use

The registry layer is valuable because independent networks need reliable coordination around globally unique number resources.

Its most important functions include:

• uniqueness;
• accurate registry state;
• contactability;
• security integrity;
• fraud resistance;
• legible changes in resource relationships; and
• operational continuity.

The governance challenge is to preserve those common functions without unnecessarily converting coordination into commercial or operational control.

Good governance does not require maximum institutional control. It requires enough reliable common coordination for independent networks to keep interoperating and operating.

For Lu Heng's original discussion of the concept, read Mandate Laundering: From RIR Fantasy to Transition Architecture .

For a broader governance framework covering registry function, portability and operational continuity, read The Policy Mirror .

For a broader introduction to the Internet-governance system, read Internet Governance: What It Is, How It Works and Who Shapes the Internet .

For more on ownership, registry state and network control, read Who Owns IP Addresses? .

For LARUS customers concerned with maintaining long-term public network identity, explore LARUS IPv4 Leasing Continuity Assurance .