2. The method of claim 1 , wherein the step of enforcing the type-level customization policy comprises: determining a policy value from a session context of the software application, the policy value indicating a username, group, or role of a current user of the software application; and determining, based on the policy value, the type-level customization policy, and a set of default behavior rules, whether an instance of the object included in the base metadata document may be customized by the current user.
2. The method of claim 1 , wherein the step of enforcing the type-level customization policy comprises: determining a policy value from a session context of the software application, the policy value indicating a username, group, or role of a current user of the software application; and determining, based on the policy value, the type-level customization policy, and a set of default behavior rules, whether an instance of the object included in the base metadata document may be customized by the current user. 3. The method of claim 2 , wherein if no customization policy is defined for the object type, the set of default behavior rules indicates that instances of objects having the object type may not be customized by users of the software application.