Soft Constraints for Security