foo nested !foo !bar security doctrine