T is for "Transit Policy Checked". You can find an explanation in the Kerberos Users' Guide: http://web.mit.edu/kerberos/www/krb5-1.3/krb5-1.3.1/doc/krb5-user.html#Viewing%20Your%20Tickets%20with%20klist Jen