Certificate-based access control

Certificate = cryptographically signed object that lists allowed operations for the holder
Service providers buy certificates from the network operator for service deployment
SPs sell certificates to the customers for the service access
The Calypso execution environment parses the certificates and grants access rights