Establishing a positive security model for application control