We need a place to make some general statement on security/access requirements, for ex.:
1 - Do not allow Security_Policy_None (at least not in production)
2 - Enforce user identity profiling to access objects/methods (which would give an "access denied" if unverified).