Class(sec:_BastionHost complete restriction(sec:hasAsset allValuesFrom(sec:BastionHost)) sec:HasAsset)