1. A computer-implemented method for a security enforcement strategy for a composite application, comprising: providing a workflow for the composite application, the composite application constructed from a set of sub-applications, at least a plurality of the sub-applications each having a policy; generating, using a processor of a machine, a consolidated workflow policy for the workflow by combining the policies of the sub-applications and by taking into account a control flow of the workflow, the control flow providing an order in which the set of sub-applications are performed; and enforcing the consolidated workflow policy using a security index structure based on labels applied to the sub-applications and path labels representing positions of the sub-applications on corresponding execution paths in the workflow, the enforcing of the consolidated workflow policy by using the security index structure for the consolidated workflow policy adapted for checking authorization in the workflow at a start of the workflow based on a request being from a fully authorized user and the enforcing of the consolidated workflow policy by using the security index structure for the consolidated workflow policy adapted for checking authorization in the workflow at the start of the workflow and at a switch block entered in the workflow based on the request being from a partially authorized user.