Todo on security principal