Using attribute certificate, the service or resource host does not need to maintain an access control list that can potentially be large or to always be connected to a network to access a central server like when using Kerberos. It is similar to the idea of capabilities in which the permission (or permissions) to use a service or resource is not stored in the service or resource itself but in the users using a tamper resistance mechanism.