The entity that applies the governance rules for STIR/SHAKEN in the United States, deciding which providers may obtain signing certificates and which certificate authorities are trusted.
The SHAKEN governance model has three layers. The Secure Telephone Identity Governance Authority (STI-GA) sets policy. The Policy Administrator (STI-PA) carries that policy out day to day. Certification authorities (STI-CAs) issue the actual certificates. The STI-PA sits in the middle, approving service providers and certification authorities and maintaining the list of trusted CAs that verifiers rely on.
A provider that wants to sign calls registers with the STI-PA and, once approved, can request a Service Provider Code (SPC) token. The SPC token proves to a certification authority that the provider is authorized to receive a STIR/SHAKEN certificate. Eligibility criteria have included holding an Operating Company Number, filing the appropriate FCC forms, and maintaining a current Robocall Mitigation Database certification.
The STI-PA can also revoke a provider's SPC token when governance rules call for it, for example when a provider is removed from the Robocall Mitigation Database. Revocation means the provider can no longer obtain or renew certificates, which effectively ends its ability to sign calls. Because revocation is visible to the whole ecosystem, it also signals to peers that a provider has fallen out of good standing, which can affect commercial relationships well beyond signing.
Why it matters to carriers
Your relationship with the STI-PA is the foundation of your ability to sign traffic. Lapsed registrations, out-of-date RMD filings, or changes to your OCN can interrupt token issuance and leave your traffic unsigned. Treat STI-PA account health as an operational dependency, with a named owner and a calendar for renewals and filings.