A proper subset of a security domain's entities which are subject to a security policy which possesses the following properties: 1. It includes all of the rules of the super-domain's policy where they apply; 2. Additional rules are defined for the sub-domain policy action types where permitted by the policy of the super- domain; 3. It is administered by an Administration authorized by the super-domain's Administration.