In general, the invention is directed to techniques for offloading per-subscriber traffic management from an access gateway to one or more upstream service nodes within a service provider network. For example, as described herein, an upstream service node receives a new packet flow for a subscriber and sends packet flow information, such as a network address, to a session and resource controller (SRC). The SRC maintains a table of subscriber attachment sessions and maps the packet flow information to a subscriber attachment session in the table to obtain a subscriber identifier for a subscriber. The SRC then determines subscriber-specific services to be applied to subscriber data traffic, transforms the services to a set of one or more enforcement policies, and returns the enforcement policies to the service node. In turn, the service node applies the enforcement policies for the subscriber-specific services to the subscriber data traffic in the packet flow.