Access control policies and languages in open environments