Ethernet passive optical networks (EPONs) are designed to deliver services for numerous applications such as voice over Internet protocol, standard and high-definition video, video conferencing (interactive video), and data traffic. Various dynamic bandwidth allocation and intra-optical network unit (ONU) scheduling algorithms have been proposed to enable EPONs to deliver differentiated services for traffic with different quality of service (QoS) requirements. However, none of these protocols and schedulers can guarantee bandwidth for each class of service nor can they protect the QoS level required by admitted real-time traffic streams. In this paper, we propose the first framework for per-stream QoS protection in EPONs using a two-stage admission control (AC) system. The first stage enables the ONU to perform flow admission locally according to the bandwidth availability, and the second stage allows for global AC at the optical line terminal. Appropriate bandwidth allocation algorithms are presented as well. An event-driven simulation model is implemented to study the effectiveness of the proposed schemes in providing and protecting QoS.