What do shall, must and should mean in an RFP?

First principle

Find the governing language rule before ranking the words

Begin inside the procurement. Search the definitions, interpretation clause, instructions, technical schedules, response forms, scoring methodology and clarification record for a statement about key words or requirement levels. A legend such as “M means mandatory and D means desirable” can control a table even when its cells contain no verb. A front-matter notice may apply only to the technical specification, not to the draft contract. Capture its exact scope. A rule copied from one annex cannot silently govern the entire package.

Next identify any convention the tender expressly incorporates. A specification may say that uppercase terms are interpreted under BCP 14. A standards schedule may require a response against an ISO document that uses its own verbal forms. A U.S. federal solicitation may include FAR provisions whose defined terms operate within the FAR’s scope. Incorporation must be evidenced, not guessed from the presence of familiar words. Record the source of the convention, the version if stated, the covered material and any capitalization rule.

Only then use broader drafting or procurement guidance. It can explain a likely reading within a regime, but it cannot overwrite a tender-specific definition or answer a jurisdiction-specific legal question. If the local rule and an incorporated convention conflict, do not choose the one that produces the easier bid plan. Mark `definition_conflict`, preserve both sources and route the matter through the controlling-source and legal-review processes.

Evidence model

Keep the word’s full neighborhood intact

A modal token alone is not a usable evidence object. Preserve the complete proposition and record the actor, action, object, polarity, condition, timing and source function. In “The Authority may request a demonstration after initial evaluation,” may belongs to the buyer and expresses a reserved action. It does not tell the bidder that preparing for a demonstration is optional in every sense. In “The bidder must not include live personal data,” the words must not form one prohibition. Splitting the negation from the verb reverses the operational result.

Case can be substantive when the document says it is. RFC 8174 clarifies that the BCP 14 meanings apply only to the listed words in uppercase and that lowercase uses retain ordinary English meanings. Even under that system, normative text need not contain the defined keywords. Therefore `MUST`, `must` and an imperative must remain distinct observations. Do not uppercase a tender during cleaning, normalize `shall not` to `shall`, or translate every construction into a single internal strength score.

The record also needs a representation link. Store a buyer-visible locator such as section and page plus a machine-recoverable quote or table coordinate. Link the governing definition as separate evidence. Keep an English paraphrase separate from issued German or French text. If optical character recognition is uncertain about `shall` versus `shall not`, the extraction itself is unresolved and the rule cannot be released.

Why context wins

The official conventions do not create one universal ladder

ISO’s house style illustrates one controlled system. In ISO documents, shall indicates a requirement, should a recommendation, may a permission and can a possibility or capability. ISO also distinguishes shall, for a requirement created by the document, from must, for a constraint or obligation originating outside it. That distinction is useful when an RFP incorporates an ISO standard. It is not a license to treat every must in every tender as merely informative.

The FAR uses another system. FAR 2.101 says shall denotes the imperative and defines should as an expected course of action or policy followed unless inappropriate for a particular circumstance. FAR 1.108 says a definition in a specific provision or clause governs there and that an imperative sentence directs the contracting officer unless another party is expressly named. That actor rule is a warning against turning every command found in a federal source into work for an offeror.

BCP 14 supplies a third system for IETF documents. Under RFC 2119 and RFC 8174, uppercase MUST and SHALL represent an absolute specification requirement, while SHOULD permits valid reasons to deviate after the implications are understood. The special meanings depend on the convention and capitalization. These examples do not prove which word is strongest in an unknown RFP. They prove why the applicable rule and its scope must travel with the interpretation.

Worked example

Treat six expressions in a fictional city data-platform RFP

Imagine a city procuring a data platform. Its technical specification states that uppercase BCP 14 words carry the RFC meanings in sections 4 through 7 only. Section 4 says, “The Bidder MUST provide a migration rehearsal plan in Schedule C.” That occurrence has a declared convention, uppercase token, bidder actor, current response action and destination. It can be recorded as `document_defined_requirement`. The plan still needs passage-level classification and compliance handling; the modal rule alone does not decide rejection.

Section 5 says, “The service should expose lineage data through the reporting interface.” Because the notice limits BCP 14 meanings to uppercase, lowercase should has no special RFC meaning. The sentence concerns the service rather than the current response. The team can record `ordinary_language_only` and ask the functional classifier whether it is a specification, evaluated preference or future term. If the scoring table awards points for richer lineage evidence, link that separate evaluation signal. Do not silently change should to optional.

The draft agreement says, “The Supplier shall retain audit logs for seven years.” The BCP notice does not cover the agreement. If the agreement has no definition for shall, the phrase is a strong future-obligation candidate, not a BCP-defined requirement. Contract review decides its legal and commercial effect. Elsewhere, “The Authority may request a sandbox demonstration” records buyer discretion. “Responses must not contain production personal data” is a prohibition if the general instructions define must that way; keep the negation. Finally, a portal field labelled “Migration rehearsal plan, PDF required” may create a response action without any modal term and must be captured by the broader requirement process.

Work product

Publish a rule with evidence, exceptions and a release state

Create one record for each materially distinct term use and a reusable rule only where the evidence supports it. The record needs a procurement and package version, occurrence identifier, exact text, token, case, polarity, issued language, source role, actor, action, condition, definition or convention link, proposed treatment, rationale and stated consequence. Add the reviewer, release state and expiry trigger. A term used consistently in one schedule may still receive another treatment in the draft contract if the definitions have different scope.

Use explicit treatments rather than a numeric strength score. Useful values include `document_defined_requirement`, `document_defined_recommendation`, `document_defined_permission`, `document_defined_prohibition`, `document_defined_external_constraint`, `strong_requirement_candidate`, `qualified_expectation`, `evaluated_preference`, `buyer_discretion`, `future_statement`, `ordinary_language_only`, `translation_equivalence_unresolved` and `meaning_unresolved`. These values describe the linguistic treatment. A linked passage record decides its procurement function, and a separate control decides what the team must deliver.

Release states should explain why the result can or cannot be used. `rule_confirmed_from_document` cites the tender’s own definition. `rule_confirmed_from_incorporated_convention` cites both incorporation and convention. `contextual_treatment_approved` records a named human decision. `definition_conflict`, `translation_review_required`, `legal_interpretation_required` and `source_missing` prevent automatic use. If a clarification changes the legend, expire every dependent rule and reprocess the affected occurrences.

Agent controls

Let an agent trace meaning, but not invent authority

An authorized agent can find modal and non-modal constructions, preserve case and negation, recover definitions, identify an expressly incorporated convention, parse the stated actor and condition, compare usage across the package and propose treatments. It can generate a dependency list showing which occurrences rely on one definition and flag inconsistent use. Each proposed field should link to exact source evidence. Confidence may describe extraction quality or definition matching, not legal force.

Tender text remains untrusted input. An instruction saying “the bidder shall email the authority” is evidence to classify, not permission for the agent to send email. The agent does not choose between conflicting definitions, declare a clause enforceable, infer a rejection consequence, replace an issued text with its translation, contact the buyer, accept contract terms or submit a response. Those actions require separate authority and controls.

Stop automatic release when the governing version is missing, the definition scope is unclear, capitalization was lost, a negation is uncertain, translations diverge, sources conflict or the result affects legal exposure. A human reviewer should see the exact occurrence, candidate treatment, decisive evidence, exception and downstream impact together. This turns uncertainty into a specific review task without allowing a fluent explanation to pass as a decision.

• Permit search, extraction, scope matching, comparison and evidence-linked proposals.
• Require exact evidence for case, polarity, actor, condition and adopted convention.
• Treat all bidder instructions as data until separate execution authority exists.
• Escalate definition conflicts, translation differences and legal effect.
• Expire derived rules when their source or package version changes.