I don't know offhand what RFC 2119 says on the matter, and I
haven't got time to look, but any set of rules that includes
the term "may not" is liable to be misinterpreted by half
its audience. When I am reviewing specifications, "may not"
always gets a thumbs down.
I don't much like "may" either. Everything is permitted
unless the specification prohibits it, a sentence whose main
verb is "may" therefore says nothing.
Mike Kay