Complexity is reduced and performance is improved when enforcing security restrictions on the execution of program code in a runtime environment. Units of executable code, such as methods or functions, are classified by "security level." Code units belonging to a "trusted" security level may call any other code unit in the runtime environment, but other security levels are restricted in the code units they can call. Code units may also have "instance permissions" to allow them to have permission to call other individually-specified code units that they would normally be precluded from calling, due to their security level. The security level scheme described herein reduces the complexity of establishing permissions with respect to different code units in the runtime environment. This security level scheme also improves runtime performance by making it unnecessary to check individually-defined permissions in many cases.