Santosh, ...snip Russ: In that case, we do not need to do much since RP can get the attribute certificate policy from the certificate and make its own decision. [Chris Francis - WetStone Technologies] And there's the rub. Currently there's no place to put the attribute certificate policy in the certificate. Do you support the idea of adding an extension for this purpose? Chris