Security is not an add-on: it is part of the platform design.
By user, by group, by application or based on a field value.
Every user identified and every action recorded with its author.
Collaborating systems must be properly identified.
Deployable in distributed environments and built to scale.