Index: java/net/deterlab/abac/Context.java
===================================================================
--- java/net/deterlab/abac/Context.java	(revision 152673ddb21adfe8ed9c35ab58c6e5bb7c1cee24)
+++ java/net/deterlab/abac/Context.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
@@ -1073,4 +1073,15 @@
 
     /**
+     * Return a new credential supported by this Context.  It is not inserted
+     * in the Context.
+     * @param head a Role, the head of the encoded ABAC statement
+     * @param tail a Role, the tail of the decoded ABAC statement
+     * @return a Credential encoding that ABAC statement
+     */
+    public Credential newCredential(Role head, Role tail) {
+	return credentialFactory.generateCredential(head, tail);
+    }
+
+    /**
      * Get to the SHA1 hash of the key.  Used by Roles and Identities to get a
      * key ID.
Index: java/net/deterlab/abac/Credential.java
===================================================================
--- java/net/deterlab/abac/Credential.java	(revision 152673ddb21adfe8ed9c35ab58c6e5bb7c1cee24)
+++ java/net/deterlab/abac/Credential.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
@@ -218,15 +218,19 @@
 
     /**
-     * Return a CredentialParser that never parses a credential.  Credentials
-     * that can be parsed must override this.  Called indirectly by
+     * Return a CredentialParser that never parses or generates a credential.
+     * Credentials that can be parsed must override this.  Called indirectly by
      * CredentialFactory.registerClass().
-     * @return a CredentialParser for this kind of credential.
-     */
-    static public CredentialParser getCredentialParser() { 
-	return new CredentialParser() {
+     * @return a CredentialFactorySpecialization for this kind of credential.
+     */
+    static public CredentialFactorySpecialization 
+	    getCredentialFactorySpecialization() { 
+	return new CredentialFactorySpecialization() {
 	    public Credential[] parseCredential(InputStream s, 
 		    Collection<Identity> ids) { 
 		return null; 
 	    } 
+	    public Credential generateCredential(Role head, Role tail) {
+		return null;
+	    }
 	};
     }
Index: java/net/deterlab/abac/CredentialFactory.java
===================================================================
--- java/net/deterlab/abac/CredentialFactory.java	(revision 152673ddb21adfe8ed9c35ab58c6e5bb7c1cee24)
+++ java/net/deterlab/abac/CredentialFactory.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
@@ -15,5 +15,5 @@
  */
 public class CredentialFactory implements Cloneable {
-    protected List<CredentialParser> parsers;
+    protected List<CredentialFactorySpecialization> spec;
     static public String defName = "net.deterlab.abac.GENICredential";
     public static final int maxSize = 50 * 1024;
@@ -24,5 +24,5 @@
      */
     public CredentialFactory() throws ABACException {
-	parsers = new ArrayList<CredentialParser>();
+	spec = new ArrayList<CredentialFactorySpecialization>();
 	registerClass(defName);
     }
@@ -37,5 +37,5 @@
      */
     public CredentialFactory(Collection<String> names) throws ABACException {
-	parsers = new ArrayList<CredentialParser>();
+	spec = new ArrayList<CredentialFactorySpecialization>();
 	for (String n : names ) 
 	    registerClass(n);
@@ -51,5 +51,5 @@
      */
     public CredentialFactory(String[] names) throws ABACException {
-	parsers = new ArrayList<CredentialParser>();
+	spec = new ArrayList<CredentialFactorySpecialization>();
 	for (String n : names ) 
 	    registerClass(n);
@@ -65,8 +65,8 @@
 	this();
 
-	parsers = new ArrayList<CredentialParser>();
-
-	for ( int i = 0; i < parsers.size(); i++) 
-	    parsers.add(cf.parsers.get(i));
+	spec = new ArrayList<CredentialFactorySpecialization>();
+
+	for ( int i = 0; i < spec.size(); i++) 
+	    spec.add(cf.spec.get(i));
     }
 
@@ -105,10 +105,10 @@
 	ABACException err = null;
 
-	if (!is.markSupported() && parsers.size() > 1) 
+	if (!is.markSupported() && spec.size() > 1) 
 	    is = new BufferedInputStream(is, maxSize);
-	if (parsers.size() > 1)
+	if (spec.size() > 1)
 	    is.mark(maxSize);
 
-	for (CredentialParser c : parsers ) {
+	for (CredentialFactorySpecialization c : spec ) {
 	    try {
 		rv = c.parseCredential(is, ids);
@@ -120,5 +120,5 @@
 	    }
 	    try {
-		if (parsers.size() > 1) is.reset(); 
+		if (spec.size() > 1) is.reset(); 
 	    }
 	    catch (IOException ie) { 
@@ -174,7 +174,19 @@
 
     /**
-     * Add the named class to the list of usable parsers.  The class passed in
-     * must have a static getCredentialParser() method that returns a
-     * CredentialParser to use.
+     * Return a credential of the from the first
+     * CredentialFactorySpecialization in the factory.
+     * @param head a Role, the head of the encoded ABAC statement
+     * @param tail a Role, the tail of the decoded ABAC statement
+     * @return a Credential encoding that ABAC statement
+     */
+    public Credential generateCredential(Role head, Role tail) {
+	if (spec.isEmpty()) return null;
+	return spec.get(0).generateCredential(head, tail);
+    }
+
+    /**
+     * Add the named class to the list of usable specializations.  The class
+     * passed in must have a static getCredentialFactorySpecialization() method
+     * that returns a CredentialFactorySpecialization to use.
      * @param name a String containing the binary name of the class to register
      * @throws ABACException if there is a problem.  The cause field of this
@@ -183,12 +195,12 @@
     public void registerClass(String name)
 	throws ABACException {
-	CredentialParser cp = null;
+	CredentialFactorySpecialization cs = null;
 
 	try {
 	    /* <?> doesn't guarantee much, but shuts the compiler up */
 	    Class<?> c =  Class.forName(name);
-	    Method m = c.getMethod("getCredentialParser");
-
-	    cp = (CredentialParser) m.invoke(null);
+	    Method m = c.getMethod("getCredentialFactorySpecialization");
+
+	    cs = (CredentialFactorySpecialization) m.invoke(null);
 	}
 	catch (Exception e) {
@@ -197,5 +209,5 @@
 	}
 
-	parsers.add(cp);
+	spec.add(cs);
     }
 }
Index: java/net/deterlab/abac/CredentialFactorySpecialization.java
===================================================================
--- java/net/deterlab/abac/CredentialFactorySpecialization.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
+++ java/net/deterlab/abac/CredentialFactorySpecialization.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
@@ -0,0 +1,36 @@
+package net.deterlab.abac;
+
+import java.io.*;
+import java.util.*;
+import java.lang.reflect.*;
+
+
+/**
+ * This class parses or generates credentials.  The parser produces one or more
+ * Credentials.  the generator produces exactly one credential. Each class that
+ * wants to be parsed and generated needs to export a static method that
+ * returns one of these.  For credentials that parse 1 credential to 1 input it
+ * will be a wrapper around a constructor.
+ * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
+ * @version 1.4
+ */
+public abstract class CredentialFactorySpecialization {
+    /**
+     * Parse one or more Credentials from the given input and IDs.  The
+     * sub-type of Credential returned is up to this class.
+     * @param is an InputStream to be parsed
+     * @param ids a Collection of Identity s to use in validating credentials.
+     * @return an array of Credentials
+     * @throws ABACException on parsing problems
+     */
+    public abstract Credential[] parseCredential(InputStream is, 
+	    Collection<Identity> ids) throws ABACException;
+
+    /**
+     * Return an object derived from a credential with the given roles.
+     * @param head a Role, the head of the encoded ABAC statement
+     * @param tail a Role, the tail of the decoded ABAC statement
+     * @return a Credential encoding that ABAC statement
+     */
+    public abstract Credential generateCredential(Role head, Role tail);
+}
Index: java/net/deterlab/abac/CredentialParser.java
===================================================================
--- java/net/deterlab/abac/CredentialParser.java	(revision 152673ddb21adfe8ed9c35ab58c6e5bb7c1cee24)
+++ 	(revision )
@@ -1,27 +1,0 @@
-package net.deterlab.abac;
-
-import java.io.*;
-import java.util.*;
-import java.lang.reflect.*;
-
-
-/**
- * This class parses one or more Credentials.  Each class that wants to be
- * parsed needs to export a static method that returns one of these.  For
- * credentials that parse 1 credential to 1 input it will be a wrapper around a
- * constructor.
- * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
- * @version 1.4
- */
-public abstract class CredentialParser {
-    /**
-     * Parse one or more Credentials from the given input and IDs.  The
-     * sub-type of Credential returned is up to this class.
-     * @param is an InputStream to be parsed
-     * @param ids a Collection of Identity s to use in validating credentials.
-     * @return an array of Credentials
-     * @throws ABACException on parsing problems
-     */
-    public abstract Credential[] parseCredential(InputStream is, 
-	    Collection<Identity> ids) throws ABACException;
-}
Index: java/net/deterlab/abac/GENICredential.java
===================================================================
--- java/net/deterlab/abac/GENICredential.java	(revision 152673ddb21adfe8ed9c35ab58c6e5bb7c1cee24)
+++ java/net/deterlab/abac/GENICredential.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
@@ -591,15 +591,19 @@
 
     /**
-     * Return a CredentialParser for GENICredentials.  Used by the
-     * CredentialFactory to parse these kind of credentials.  It is basically a
-     * constuctor call.
-     * @return a CredentialParser for this kind of credential.
-     */
-    static public CredentialParser getCredentialParser() {
-	return new CredentialParser() {
+     * Return a CredentialCredentialFactorySpecialization for GENICredentials.
+     * Used by the CredentialFactory to parse and generate these kind of
+     * credentials.  It basically wraps constuctor calls.
+     * @return a CredentialFactorySpecialization for this kind of credential.
+     */
+    static public CredentialFactorySpecialization 
+	    getCredentialFactorySpecialization() {
+	return new CredentialFactorySpecialization() {
 	    public Credential[] parseCredential(InputStream is, 
 		    Collection<Identity> ids) throws ABACException {
 		return new Credential[] { new GENICredential(is, ids) }; 
 	    }
+	    public Credential generateCredential(Role head, Role tail) {
+		return new GENICredential(head, tail);
+	    }
 	};
     }
Index: java/net/deterlab/abac/X509Credential.java
===================================================================
--- java/net/deterlab/abac/X509Credential.java	(revision 152673ddb21adfe8ed9c35ab58c6e5bb7c1cee24)
+++ java/net/deterlab/abac/X509Credential.java	(revision 6b31de638ea19a82f4b9aaaa67d2bcfb4d3f7e88)
@@ -322,15 +322,19 @@
 
     /**
-     * Return a CredentialParser for X509Credentials.  Used by the
-     * CredentialFactory to parse these kind of credentials.  It is basically a
-     * constuctor call.
+     * Return a CredentialFactorySpecialization for X509Credentials.  Used by
+     * the CredentialFactory to parse and generate these kind of credentials.
+     * It is basically a wrapper around constuctor calls.
      * @return a CredentialParser for this kind of credential.
      */
-    static public CredentialParser getCredentialParser() {
-	return new CredentialParser() {
+    static public CredentialFactorySpecialization 
+	    getCredentialFactorySpecialization() {
+	return new CredentialFactorySpecialization() {
 	    public Credential[] parseCredential(InputStream is, 
 		    Collection<Identity> ids) throws ABACException {
 		return new Credential[] { new X509Credential(is, ids) }; 
 	    }
+	    public Credential generateCredential(Role head, Role tail) {
+		return new X509Credential(head, tail);
+	    }
 	};
     }
