One of the important innovations of SDSI is the use of linked local name spaces. This paper suggests a logical explanation of SDSI's local name spaces, as a complement to the operational explanation given in the SDSI definition. In SDSI, each principal has a name space where names are bound to values, possibly by reference to the name spaces of other principals.
Group certificates allow treating a set of entities as a single entity.
On SDSI's linked local name spaces. 10th IEEE Computer Security Foundations Workshop, pages 98108, Rockport, MA, June 1997. IEEE Computer Society Press. Abadi et al. A calculus for access control in distributed systems - Abadi, Burrows et al.