1. A method comprising: receiving, at a computer system, a request from a first composite application to invoke a web service operation of a second composite application, wherein the first application is associated with a reference policy, and the second application is associated with a service policy; determining, by the computer system, based upon the service policy and the reference policy, whether local invocation of the web service operation is secure; and invoking the web service operation using the local invocation in response to determining that local invocation is secure.