This playbook covers the operational controls around Network Remote ID. Confirm the accepted F3411 version, local privacy rules, and participant role before exchanging production observations.
Separate the two participant roles
Document whether each deployment instance acts as a Service Provider, Display Provider, or both. Give each role its own credentials, authorization policy, health indicators, and evidence. A passing display workflow does not prove service-provider behavior.
Map every externally visible participant identifier to an internal owner and rotation procedure. Test revocation before commissioning.
Run multiple interface versions deliberately
Keep version negotiation explicit at the boundary. Normalize observations into a canonical internal record while preserving the source version and raw message reference. Do not discard a field merely because an older consumer cannot display it.
Contract-test each supported version and reject ambiguous payloads. Version fallback should be a configured choice with an audit event, never a silent retry.
Preserve quality, source, and staleness
For every observation, retain source time, receive time, position quality, identification source, and current staleness. UI surfaces should distinguish unknown values from values of zero.
Define when an observation becomes stale and when it leaves the active picture. Those thresholds belong to deployment configuration and operational procedure; they are not universal aviation truths.
Show coverage gaps
Publish the planned coverage area, sensor or network health, last observation time, and known exclusions. An area with no reported aircraft may be clear, uncovered, delayed, or failed. The display must show which interpretation is supported.
Exercise loss of one provider, total upstream isolation, and delayed recovery. Operators need an explicit degraded-state rule before the first outage.
Fuse without inventing tracks
When Remote ID and ADS-B observations may describe the same aircraft, correlate by defensible identifiers, time, motion, and uncertainty. Preserve both source observations and expose correlation confidence. Do not merge solely because positions are close.
Allow an operator to separate an incorrect correlation and record why. Beta fusion results should never lose their source labels or appear more authoritative than the underlying feeds.
Control identity access and retention
Separate the broad operational picture from access to operator identity or sensitive registration details. Apply tenant and role scope to queries, exports, and notifications. Log access to protected identity fields.
Set retention by purpose and jurisdiction. Validate deletion and legal-hold behavior in a restore copy as well as the live database.
Commissioning checks
- Both participant roles have independent credentials and tests.
- Every observation exposes source, quality, receive time, and staleness.
- Coverage and provider failures are visible on the operating picture.
- Correlation preserves original observations and confidence.
- Identity detail is role-scoped and audited.
- Retention, deletion, and degraded-mode procedures have been exercised.