What is a surrogate credential?