A human authority which establishes a security policy and identifies the entities to which the policy applies.