I’m actually referring to the node version of security enforcer, which looks a bit different. There’s a screenshot in the tutorial.
But you might also be running into this bug. Adding a layout to an existing content page does not expose Server Side data
I use this method to secure pages, but I always use layouts.