IDN.2.4.Same Entity Allocation
Describe how compliance will be achieved for second-level variant labels that arise from a registration based on a second-level IDN table where all allocatable variant labels in the set must only be allocated to the same entity or withheld for possible allocation only to that entity (e.g., all allocatable second-level labels {s1, s1v1, …} under the TLD.
Response
Compliance is achieved by withholding the entire allocatable variant set. When a second-level base label is registered under a TLD using a second-level IDN table, the registry computes the complete allocatable variant set {s1, s1v1, …} from the table's variant rules and withholds every variant label from registration by any other entity. No variant in the set can be allocated to a different entity; the set is reserved so that, under policy, it could only ever be allocated to the original registrant's entity, and otherwise remains withheld. The withholding is bound to the primary registration's lifecycle and released only when the primary is removed.
Same-entity enforcement and data set. Because the whole allocatable set is withheld by default, no registrant divergence is possible for withheld variants. The same-registrant question applies only to allocated variants, and enforcement depends on the data set:
• Full data set (thick registry): the registry holds registrant identity and performs direct registrant verification, enforcing that the primary and its allocated variants are held by the same registrant and rejecting any operation that would place a set member under a different registrant.
• Minimal data set (thin registry): direct registrant verification is not possible because the registry does not hold registrant identity — the registrar is authoritative. We therefore rely on the registrar; our recommended control is to restrict registration of a variant to the same registrar that holds the canonical/main domain, keeping the set with one accountable party bound (via the RRA / registry policy) to hold the primary and its variants under the same registrant. Direct registrant verification requires a thick registry; the specific mitigation ultimately remains a Registry Operator policy decision, giveable contractual force through the RRA.
Contact channel. Communication with the registrant remains with the registrar; we do not engage the registrant directly or bypass the registrar. Our variant-registration process is registrar-facing only—variant registrations are arranged with and through the sponsoring registrar.
Registry Operator guidance. We will advise our Registry Operators (and apply, for TLDs where we act as RO) appropriate mitigations, including RRA / registry-policy provisions requiring the primary and its variants to be held by the same entity/registrant.
