your MRO architecture determines where security checks happen and how security contexts propagate. Every region needs SEC=YES.