1. A method comprising: receiving, at a computer system, a request from a first composite application to invoke a web service operation of a second composite application, wherein the first composite application is associated with a reference policy, and the second composite application is associated with a service policy; determining, by the computer system, based upon the service policy and the reference policy, whether a first mechanism that provides local invocation of the web service operation is secure, the first mechanism providing an optimized invocation of the web service compared to a second mechanism that provides invocation of the web service; and invoking the web service operation using the first mechanism that provides local invocation rather than the second mechanism in response to determining that the first mechanism that provides local invocation is secure; wherein determining whether the first mechanism that provides local invocation of the web service is secure comprises determining that an attribute associated with the reference policy and an attribute associated with the service policy indicate that the reference and service policies are applicable to local invocation determinations.