A Security Policy Should State Exactly This