glexec is an extended version of apache suexec. It takes as input a certificate chain, possibly with VOMS extensions, and a user program name to run. It checks authorization, user credentials, proper VOMS attributes and executable name. It acquires local credentials and a local (uid, gid) pair enforcing the local credential on the process. It is basically a suid program. It is used on the cream CE to change identity of the grid user before job submission and this led to idea of using it on the WN to implement traceability and Intra-VO accounting for pilot jobs.