1. A method including: generating a descriptive data structure in a first data processing device characterized by a first security aspect; specifying information in the descriptive data structure, including information relating to the first security aspect, a first rule, and a second rule; associating a third rule with the descriptive data structure, the third rule at least in part controlling use of at least a portion of the descriptive data structure; transmitting the descriptive data structure to a second data processing device; at the second environment, retrieving from the descriptive data structure the information relating to the first security aspect, the retrieval being governed at least in part by the third rule; and determining whether to use the first rule or the second rule based on the information.