How-to guide
How to write requirements with RFC-2119
Problem: Reviewers argue about whether a requirement is mandatory or a nice-to-have.
Use when: Standards, protocol specs, compliance docs, internal engineering policies.
Steps
- Add the boilerplate: cite RFC 2119 (and RFC 8174 for the capitalization rule).
- Use MUST / MUST NOT for absolute requirements; SHOULD / SHOULD NOT for strong defaults; MAY for options.
- Capitalize keywords only where normative—ordinary “should” stays lowercase.
- Phrase each requirement as one testable statement; split compound requirements.
Example
InformalClients should really validate the token, and they can cache it if they want.
NormativeClients MUST validate the token before use. Clients MAY cache a validated token until it expires.