In the C/C++ API, security is tied to the component with the idea that a vendor will likely want to lock up log messages on a per component basis. Even in strictly internal applications where security may not be so much associated with a particular product like an OCX it still applies quite naturally to things like database servers and connectivity servers. In the COM and command line interfaces that object boundary is blurred so messages are locked on a per logging object or per log message basis.