A simple and expressive semantic framework for policy composition in access control