Attaching Security Policies to Individual Operations