An authorization service need not directly specify that a particular principal be authorized to use a particular service, or access a particular object. Instead, it can issue a proxy allowing the grantee to access an object using the rights of the authorization server itself. The proxy would be restricted to allow access to only those objects, and with only those rights, to which that principal is authorized access. The same arguments for basing authorization on restricted proxies apply to accounting. Authorization depends on accounting when a server verifies that a client can pay for an operation before it is performed.
Accounting depends on authorization to control the transfer of funds from one account to another.
The IETF provides a venue for technology transfer, and participation has paid off through adoption of the technology by Microsoft and other vendors. These revisions include the definition of Triple-DES encryption for Kerberos, and authorization extensions. For authorization, several authorization data elements carried in the authorization data field have been specified to promote interoperability between authorization mechanisms built using Kerberos. These revisions have been submitted to the IETF as an Internet draft and it is anticipated that these should move forward to becoming Internet standards. A new secure version of ARDP transport protocol has been designed and developed.