A modular approach to composing access control policies