Toward More Composable Software-Security Policies: Tools and Techniques