1. Chapter 8: Security Policy
.Net Security, O’Reilly

2. Security Policy?
Set of configurable rules that provide a mapping between evidence and permissions
It is flexible and extensible
It provides administrators and users fine-grained control over the operations and resources to which code has access
With these, users can confidently run managed code from any source, knowing that the runtime takes care preventing undesirable actions by the code

3. Security Policy Levels
Enterprise policy
Machine policy
User policy
Application domain policy
Runtime intersects the sets of permissions granted by each policy level to determine the final code-access permissions set for assembly or application domain
Each policy can further restrict previous level but can never grant additional ones

4. Policy level contains
Code groups: Hierarchy of code groups based on evidence presented
Named permission sets
Fully trusted assemblies

5. Policy Resolution
Runtime uses enterprise, machine, and user policy levels when resolving the grant set for application domains