Policy Specification: Meeting Changing Requirements without Breaking the System Design Contract