1. A method for implementing security and privacy policy in a web application having an execution environment in which a representation of each object handled by the execution environment accommodates data and an associated tag, the method comprising: establishing at least one inbound tagging rule for tagging inbound objects according to a respective source of each of the inbound objects; assigning a tag to an object being operated on by the execution environment based on the at least one inbound tagging rule; establishing at least one security/privacy rule for performing security/privacy actions on outbound objects according to a respective tag of each of the outbound objects; and performing a security/privacy action on the object being operated on by the execution environment based on the at least one security/privacy rule.