1. A computer-implemented method comprising: creating a global policy container that includes global policies that are shared by multiple applications; creating multiple application-specific policy containers that include application-specific policies for individual applications; determining, based on a global policy in the global policy container and a first application-specific policy in a first application-specific policy container, whether a first application is permitted to access a particular resource; and determining, based on the global policy in the global policy container and a second application-specific policy in a second application-specific policy container, whether a second application is permitted to access the particular resource.