Abstract: An apparatus, computer program, and method are provided for generating an intermediate entitlement specification that specifies one or more access rights in connection with a service or content. A plurality of entitlement policies is stored that are configured for being used to determine one or more entitlements to be sent to a device. In operation, an offer specification is received, and at least one of the plurality of entitlement policies is identified based on the offer specification. An intermediate entitlement specification is generated that specifies one or more access rights in connection with a service or content, based on at least one entitlement policy. In use, a run-time entitlement specification may be generated, in response to a request for the service or content during a run-time. Further, in one embodiment, the run-time entitlement specification may be generated utilizing at least one intermediate entitlement specification.