security decisions