We need:

• service that provides the security context per place
• gate keeper implementation that creates the security context (or rejects access)
• API for declaring security related meta data (@AccessControl(resources=[<address,...>])) used with presenter declarations