An Internet AttributeCertificate Profile for Authorization
This PKIX draft defines two profiles for the use of X.509 AttributeCertificates to provide authorization support for protocols like TLS, CMS and their consumers, and others.