Added a security policy which is able to combine parent (for group and function) plus strict base category. It can be useful to generate groups as function* + group* + site, for example.