Security policies check data flows that pass through firewalls. Only the data flows that match the security policies are allowed to pass.