The Microsoft Kerberos documentation seems either to have moved or to have been renamed. The closest thing I could find (which may be the same thing--I'm not sure) is:

Utilizing the Windows 2000 Authorization Data in Kerberos Tickets for Access Control to Resources

John Brezak, Microsoft Corporation, February 2002
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnkerb/html/msdn_pac.asp?frame=true&hidetoc=true

Geez, what an ugly URL that is...