How to create a security policy and set rules