A mechanism provided by the common language runtime whereby managed code is granted permissions by security policy and these permissions are enforced, helping to limit the operations that the code will be allowed to perform.