add security constraint for patching resource model