An object that can restrict access to a method, workflow, or relationship based on specified criteria.