the described ticket acquisition and redemption into an application system and business context offers many variants. A very basic scenario is shown in Figure \[fig:Gen\_Arch\]. Here, a trusted agent (user) would like to access some service, and buys a ticket of a certain value from the PCA. The ticket belongs to a certain group which can represent statements such as “for usage with Service $n$”, and a certain value, monetary or intangible[, [e.g.]{},]{}in a rebate scheme. The user then issues a service request as payload in the ticket redemption toward RS. The TA pays for the ticket at the CP at the time of redemption of the ticket and the CP distributes revenue shares between himself, PCA, and RS, according to service level agreements. RS, in turn, remunerates the service (an acknowledgement of service processing is omitted for simplicity).

This realises an access control scheme to multiple services mediated by PCA and RS, yielding three essential benefits: 1. non-repudiation by the chain of credentials, 2. accountability by resolution of the TA’s identity through PCA, and 3. pseudonymity by separation of duties. The PCA/RS combination plays a very central role for the control of identities embodied in the pseudonymous tickets that 