hopefully we're sure `obj` is a non-null `SecurityContext`