draft: kerberos document