You are trying to do authorization with a physical device meant for authentication. This rarely works well.
A smart card is used to authenticate the user, in that it contains a private key which remains under exclusive use of the owner. The certificate is a method by which the link between the public key and the owner's identity are distributed; it is signed by a CA so that the physical medium by which this link information is transferred does not matter; and, in practice, the certificate is also stored on the card because the certificate is most useful when the card is used, so that's a nice emplacement. However, the certificate could also be distributed through some other means, e.g. a big public LDAP server (historically, X.509 certificates were designed to be distributed that way).
None of that tells anybody what a key owner is allowed to do; it only gives some guarantee about the identity of that person (not "what", but "who").
In a given system, once you have ascertained the identity of the requester (that's the authentication part), you have to decide whether the received request should be granted. That second part is called authorization. The really important points here are the following:
- Authorization information must be amenable to quick modifications, with a shorter granularity than the typical hours of latency of certificate revocation.
- Authorization information is not necessarily defined by the same people/entities who verify identities; i.e., the job of the CA does not naturally include rights management.
- Authorization information is sometimes negative so a key owner might not necessarily be trusted for transporting the information which qualifies himself (because the key owner may omit a "rights file" which pinpoints him as an undesirable individual).
For these reasons, what you are trying to do looks like a bad idea. However, being bad never prevented an idea from being standardized. I never saw a situation where "attribute certificates" were really put to good use, though.
On a more incidental plane, usual smart cards cannot embed a lot of public data. A 2 kB certificate is OK, but a 300 kB Word file won't fit.