don't maintain locked property on security objects, use a function