Policies: constraints and capabilities