1. At a computer system in a Web Services environment, a method of assisting a user in generating a more secure policy document by providing a rule-based tool that automatically selects security conditions for the user's general security criteria such that the user does not have exposure to all security details, the method comprising acts of: at a generation phase of the secure policy document: presenting a set of Web Service security options to the user at a user interface, which abstracts the user from any specific code that will be generated for a secure policy document that satisfies one or more of the set of Web Service security options; receiving user input selecting a general security criteria from the set of Web Service security options presented; based on the received user input, accessing one or more security rules from a repository of extensible security metadata, the one or more security rules corresponding to the general security criteria; determining whether the secure policy document to be generated is a client policy document or a service policy document; and using the one or more security rules corresponding to the general security criteria to generate the secure policy document in accordance with the general security criteria, wherein generating the secure policy document includes automatically selecting specific security conditions that enforce the general security criteria input by the user, and wherein the security conditions that are more specific than the general security criteria input by the user are automatically selected based at least in part on whether the secure policy document is determined to be a client policy document or a service policy document, such that different one or more security rules are selected and applied in creating the secure policy document when the secure policy document is a client policy document as compared to when the secure policy document is a service policy document.