1. A system for providing a computer security architecture, the system comprising: computing hardware, including at least one processor, a data store, and input/output facilities interfaced with the at least one processor, the data store containing an operating system and a plurality of subject entities executable by the at least one processor; the data store further containing a security subsystem executable by the at least one processor, that, when executed, causes the computing hardware to implement: a security server engine configured to apply selected rules, from among a set of rules defining one or more security policies, to a given set of security context parameters, to produce a security verdict representing whether a certain action requested by a subject entity is permissible, wherein each of the one or more security policies is associated with a corresponding communication interface, and wherein each of the one or more security policies is defined by at least a conjunction of a first predefined access mechanism and a second predefined access mechanism, and each of the first predefined access mechanism and the second predefined access mechanism are described in a configuration language accessible by the security server engine to implement the security policy without recompilation of the security server engine; and a plurality of gateway engines, each gateway engine being associated with at least one of the subject entities and dedicated to interfacing with the security server, each of the gateway engines being configured to: monitor requested actions by the associated at least subject entity and, for each requested action detected, identify a security context, determine an applicable security policy for the requested action based on a corresponding identified security context, and request a security verdict corresponding to the applicable security policy from the security server engine via a communication interface, wherein the request for the security verdict includes at least one security context parameter transmitted to the security server engine, the at least one security context parameter related to the requested actions, the security context, or the applicable security policy for the requested action, wherein the gateway engine is unable to produce a security verdict, and wherein the gateway engine is configured by a system-level configuration applicable to all subject entities on the system, and a reflection configuration unique to one of the subject entities; and a security enforcement engine configured to either permit or deny each of the requested actions according to the security verdict.