At an object storage service, one or more security rules to be implemented for a request directed to an unstructured object are identified, including a content query-based rule. The query-based rule indicates a query predicate and a security enforcement action. A value of an attribute is extracted from the unstructured object using a rule obtained via a programmatic interface, and used to verify that the predicate is satisfied. The security enforcement action is then implemented.