A subscriber may presently possess authenticators appropriate for authentication at a selected AAL. One example is, They could Have a very two-variable authenticator from a social network provider, viewed as AAL2 and IAL1, and would want to use those credentials at an RP that requires IAL2.