1. A system for controlling access to a software application, the system comprising: a policy machine template generator for generating a policy machine template based on roles and permissions for operators; and a policy machine generator, coupled to the policy machine template generator, for generating a policy machine based on operators and objects, wherein the policy machine: is an access control framework permitting directed acyclic graph relationships between objects; and operates to control access to the software application.