Abstract The Internet of Things includes Smart Objects, small devices with limited abilities, typically made to fulfill a single simple task. They have limited system resources, such as processing power, memory, non-volatile storage, and transmission capacity, are frequently powered from primary batteries, and often lack user interfaces and displays. These devices benefit from being associated with less-constrained devices, in particular for user interactions, as well as for defining their purpose in life in the first place, which includes setting policies relevant to security and privacy. Smart objects will be ubiquitous and attain significant insight into and control over many aspects of everyday life, which makes users expect a very high level of security and privacy of them and of the less-constrained devices controlling them. Cloud-based systems will be hard pressed to fulfill these expectations on their own: The human will need to stay in the loop at least for policy setting.