1. A computer-implemented method for a security enforcement strategy for a composite application, comprising: providing a workflow for the composite application, wherein the composite application is constructed from a set of sub-applications and wherein at least a plurality of the sub-applications has a policy; generating a consolidated workflow policy for the workflow by combining the policies of the sub-applications and by taking into account a control flow of the workflow, wherein the control flow provides an order in which the set of sub-applications are performed; and enforcing the consolidated workflow policy by providing a security index structure for the consolidated workflow policy adapted for checking authorization in the workflow.