use separate attributes for security and fallback groups