new user security model