This documentation is archived and is not being maintained.

SecurityAction Enumeration

Specifies the security actions that can be performed using declarative security.

Namespace:  System.Security.Permissions
Assembly:  mscorlib (in mscorlib.dll)

<SerializableAttribute> _
<ComVisibleAttribute(True)> _
Public Enumeration SecurityAction

Member nameDescription
DemandAll callers higher in the call stack are required to have been granted the permission specified by the current permission object (see Security Demands).
AssertThe calling code can access the resource identified by the current permission object, even if callers higher in the stack have not been granted permission to access the resource (see Using the Assert Method).
Deny Obsolete. The ability to access the resource specified by the current permission object is denied to callers, even if they have been granted permission to access it (see Using the Deny Method).
PermitOnlyOnly the resources specified by this permission object can be accessed, even if the code has been granted permission to access other resources (see Using the PermitOnly Method).
Supported by the XNA FrameworkLinkDemandThe immediate caller is required to have been granted the specified permission. Do not use in the .NET Framework 4. For full trust, use SecurityCriticalAttribute instead; for partial trust, use Demand.
InheritanceDemandThe derived class inheriting the class or overriding a method is required to have been granted the specified permission. For more information, see Inheritance Demands.
RequestMinimum Obsolete. The request for the minimum permissions required for code to run. This action can only be used within the scope of the assembly.
RequestOptional Obsolete. The request for additional permissions that are optional (not required to run). This request implicitly refuses all other permissions not specifically requested. This action can only be used within the scope of the assembly.
RequestRefuse Obsolete. The request that permissions that might be misused will not be granted to the calling code. This action can only be used within the scope of the assembly.

The following table describes the time that each security action takes place and the targets that it supports.

Important noteImportant

In the .NET Framework version 4, runtime support has been removed for enforcing the Deny, RequestMinimum, RequestOptional, and RequestRefuse permission requests. These requests should not be used in code that is based on .NET Framework 4 or later. For more information about this and other changes, see Security Changes in the .NET Framework 4.

You should not use LinkDemand in the .NET Framework 4. Instead, use the SecurityCriticalAttribute to restrict usage to fully trusted applications, or use Demand to restrict partially trusted callers.

Declaration of security action

Time of action

Targets supported

LinkDemand (do not use in the .NET Framework 4)

Just-in-time compilation

Class, method


Load time

Class, method


Run time

Class, method


Run time

Class, method

Deny (obsolete in the .NET Framework 4)

Run time

Class, method


Run time

Class, method

RequestMinimum (obsolete in the .NET Framework 4)

Grant time


RequestOptional (obsolete in the .NET Framework 4)

Grant time


RequestRefuse (obsolete in the .NET Framework 4)

Grant time


For additional information about attribute targets, see Attribute.

This example shows how to notify the CLR that code in called methods has only IsolatedStoragePermission, and also demonstrates how to write and read from isolated storage.

Option Strict On
Imports System
Imports System.Security.Permissions
Imports System.IO.IsolatedStorage
Imports System.IO

' Notify the CLR to only grant IsolatedStorageFilePermission to called methods. 
' This restricts the called methods to working only with storage files that are isolated 
' by user and assembly.
<IsolatedStorageFilePermission(SecurityAction.PermitOnly, UsageAllowed:=IsolatedStorageContainment.AssemblyIsolationByUser)> _
Public NotInheritable Class App

    Shared Sub Main()
    End Sub 'Main
    Shared Sub WriteIsolatedStorage()
        ' Attempt to create a storage file that is isolated by user and assembly.
        ' IsolatedStorageFilePermission granted to the attribute at the top of this file 
        ' allows CLR to load this assembly and execution of this statement.
        Dim s As New IsolatedStorageFileStream("AssemblyData", FileMode.Create, IsolatedStorageFile.GetUserStoreForAssembly())

            ' Write some data out to the isolated file.
            Dim sw As New StreamWriter(s)
                sw.Write("This is some test data.")
            End Try
        End Try

        ' Attempt to open the file that was previously created.
        Dim t As New IsolatedStorageFileStream("AssemblyData", FileMode.Open, IsolatedStorageFile.GetUserStoreForAssembly())
            ' Read the data from the file and display it.
            Dim sr As New StreamReader(t)
            End Try
        End Try

    End Sub
End Class 'App

' This code produces the following output.
'  Some test data.

.NET Framework

Supported in: 4, 3.5, 3.0, 2.0, 1.1, 1.0

.NET Framework Client Profile

Supported in: 4, 3.5 SP1

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows XP SP2 x64 Edition, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.