Capturing Agents in Security Models