1. Attributes, associated with a security object, that when matched against the privilege attributes of a security subject, are used to grant or deny access to the security object. 2. Attributes associated with an object that, when matched against security attributes of a subject, are used to grant or deny access to that object.