Security information objects for access control