ROA (Route Origin Authorization)
Also known as: route origin authorization
A signed RPKI object in which a prefix holder declares which ASN may originate the prefix, and the maximum prefix length allowed.
A ROA is the data an address holder publishes into RPKI. It contains a prefix, the ASN authorized to originate it, and a maxLength - the longest (most-specific) mask that authorization covers.
The maxLength matters: if a /20 has a ROA with maxLength /20, then a more-specific /24 inside it originated by the same ASN is still RPKI-invalid, because the ROA did not authorize the longer announcement. Setting maxLength too loosely, on the other hand, invites forged more-specifics.
Once a ROA exists, every BGP announcement of that prefix is checked against it during Route Origin Validation.