A trusted request is a request that contains several XML elements, including <data>, <procedure>, and <context>. The <context> element specifies the security context for a request, which is defined by user credentials such as domain name, user name, and password. Microsoft Provisioning System (MPS) uses these credentials for basic authentication of the request.

If a request does not explicitly specify user credentials, the security context of the request then becomes the COM identity of the calling user or application, as facilitated by Kerberos delegation. Whenever MPS receives a provisioning request, it uses one of these security contexts to authorize the request by performing these actions:

1. MPS first verifies whether the security identity has the right to make the type of a request being submitted, such as a trusted or untrusted request.
   
2. MPS then checks to see if there is a security identity specified in the context node of the XML request. If credentials are provided in the context node, then MPS checks to see if the identity submitting the request has the right to provide callers credentials with a request.
   
3. If a security identity is not specified in the XML request, Kerberos delegation enables MPS to adopt the security context of the calling process. If credentials are provided in the request, MPS will use those credentials to perform the provisioning actions. At this point, MPS has the security credential that will be used to perform the remaining security checks and other actions.
   
4. MPS proceeds to the next level of security implementation at the procedure level.