Key words for use in RFCs to Indicate Requirement Levels
Extracted elements (10)
Imperatives must be used with care and sparingly to preserve their meaning; overuse diminishes their normative force and imposes unnecessary constraints on implementors.
The force of these keywords is modified by the requirement level of the document in which they are used, meaning the same keyword may carry different weight depending on the overall document status (e.g., Experimental vs. Standards Track).
An implementation that includes a MAY/OPTIONAL feature MUST be prepared to interoperate with implementations that omit it; likewise, an implementation that omits a MAY feature MUST interoperate with implementations that include it.
MAY (or OPTIONAL) means the item is truly optional. An implementation that does not include a particular option MUST be prepared to interoperate with another implementation that does include the option, and vice versa.
MUST NOT (or SHALL NOT) means the definition is an absolute prohibition of the specification.
MUST (or REQUIRED or SHALL) means the definition is an absolute requirement of the specification.
SHOULD NOT (or NOT RECOMMENDED) means there may exist valid reasons in particular circumstances when the particular behavior is acceptable or even useful, but the full implications should be understood and the case carefully weighed before implementing any behavior described with this label.
SHOULD (or RECOMMENDED) means there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.
These imperative keywords MUST only be used where actually required for interoperation or to limit behavior with potential for causing harm; they must not be used to impose a particular method on implementors where the method is not required for interoperability.
These terms are frequently used to specify behavior with security implications. The effects on security of not implementing a MUST or SHOULD, or doing something the specification says MUST NOT or SHOULD NOT be done, may be very subtle. Document authors should elaborate the security implications of not following recommendations or requirements.