And here user security policies come into play