Move security policy to json.