I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on certain object. An example would be resource1 wants to fetch-profile of resource2. Here resource1 is the subject and fetch-profile is the action. Whereas resource2 is the object in this case on whom some action is to be performed by some other entity.
The subject and action parts are easily achievable with attribute certificates. Subject is the subject of the AC and I am modeling action using the Role attribute. However I am not sure how or if it's possible to achieve what I want with the object entity. I would really appreciate any help on this matter.
Note: A typical application where the subject assumes the identity of the object within certain scopes (e.g. with oAuth2) is not really applicable in my case. I want subject to maintain its own identity and do some action on some other entity. And I want to model this access criteria using attribute certs.