Security policy is a definition of what is mean to be secure for a system, organization or other entity. For an organization, it addresses the constraints on behavior of its member as well as constrains imposed on adversaries by mechanisms such as doors, locks, keys and walls. For systems, the security policy addresses constraints on functions and flow among them, constrains on access by external systems and adversaries including programs and access to data by people.