A general term covering both privilege attributes and control attributes. The use of security attributes is defined by a security policy.