Security policy: Evaluation penalty box