simple security based on entity