Defining security baselines and guardrails with access and organization policies