initial security policy. Still need to fill out the rest of the outline. @brianr