Due to the abstraction of security policy, "may" is probably better. It may be worth explicitly noting that satisfying security policy with respect to authentication MUST be a prerequisite to TGT creation.