Each security feature should only affect the companies we define. Is this archivable and how?

Assignment of security features to users are per company.

(As security features are implemented as an extension, they are global and available for all companies, but assignment are within a company).