PA user licenses are based on a honor system and are sanctioned per the Cisco software end user license agreeement (EULA). You are authorized to run as many PA users as you have ordered. There is no unique serial ID that is provided like there is for speech and TTS licenses. PA doesn't provide a report to determine how many rule sets are active. If you want to add more users, you just following the instructions in the PA admin guide for configuring a PA user. Again, the enforcement policy is based on how many users have been ordered and our sanctioned by the Cisco EULA. Additionally, when you receive your PA user certificate it also acts as a paper license and references the Cisco EULA.