Creating and evaluating security rules