how can i treat the security not as the username but i want to treat the security as a group policy ?