How can I protect SUB-ALLOCATED PA objects?
inetnum objects with the SUB-ALLOCATED PA "status:" use the same attributes as inetnums, therefore they must be protected by a valid maintainer, i.e. mnt-by. Hierarchical authority for SUB-ALLOCATED PA address space can also be specified in the "mnt-lower" and "mnt-routes" attributes.
As LIRs are responsible for all objects within their allocated ranges, it is important they take appropriate steps to ensure they retain some control over the sub-allocated space. We recommend that LIRs ALWAYS EXCLUSIVELY retain mnt-by: of sub-allocations. This will ensure that the address space is not kept by a downstream network if the reseller ceases to receive connectivity from the LIR's network.
When creating a more-specific object under a SUB-ALLOCATED PA object (a route object for example) the hierarchical structure of authorisation will apply to the maintainer(s) of the SUB-ALLOCATED PA object before checking with the maintainer(s) of the ALLOCATED object.