1. A method of providing conditional grants of permission based on an externally defined security policy, the method comprising: reading with a mid-tier application executing on a computer system a condition clause from a grant statement defined in the security policy, the grant statement granting permission for a user to access a requested resource, wherein the grant statement is defined in a security policy external to the mid-tier application, wherein the mid-tier application controls access to the resource, and wherein the grant statement comprises a Java Authentication and Authorization Service (JAAS) grant statement; determining with the mid-tier application executing on the computer system one or more constraints on the grant statement based on the condition clause; and granting with the mid-tier application executing on the computer system permission to access the requested resource based on the one or more constraints.