implementing security to work with both users and applications