XML security statements