1. A computer-implemented method comprising: identifying, by a computer system of an access management system, a global policy that is stored within a global policy container and that is shared by multiple applications, wherein the identified global policy includes a global rule for determining access to a resource by a plurality of applications; identifying, by the computer system, a first application-specific container from application-specific policy containers, the first application-specific container identified based on an association with a first application, wherein each of the application-specific policy containers stores an application-specific policy that includes an application-specification rule for determining access to a resource by an application associated with the application-specific policy container; determining, by the computer system, by applying the global rule of the global policy and a first application-specific rule of the identified first application-specific container, whether the first application is permitted to access a requested resource; identifying, by the computer system, a second application-specific container from the application-specific policy containers, the second application-specific container identified based on an association with a second application; and determining, by the computer system, by applying the global rule of the global policy and a second application-specific rule of a second application-specific policy in the identified second application-specific container, whether the second application is permitted to access the requested resource.