A persisted object model is loaded from an object model document comprising a compiled executable file having an image source, a security source, and a loader. The loader is instantiated, and instantiates the object model from the image source and a security agent from the security source to control access to the instantiated object model. The loader returns to a commander a first reference to the instantiated security agent, whereby the commander in employing the first reference accesses the security agent rather than the instantiated object model. A commander issues a command to the instantiated object model by way of the first reference to the security agent, and the security agent receives and reviews same according to pre-defined rules to determine whether the object model should in fact receive the command. If so, the security agent forwards the command to the object model.