Devices and device groups are referenced in security policies, so that user permissions can be controlled based on users' device types.