An enhanced CFA for security policies