Security policy: Conditions and exceptions