s4: use toplevel security.idl