security domain access control meta data
introduce the "addressable" constraint