implemented a basic qualified-permission based security context