1. A method comprising: retrieving, by a computer system, policy attachment metadata identifying a web service policy and a policy subject, the policy attachment metadata indicating that the web service policy should be attached to the policy subject; receiving, by the computer system from an end-user, a constraint expression configured to return a Boolean result, the constraint expression being dependent on at least one parameter whose value is only available at runtime of the policy subject; and modifying, by the computer system, the policy attachment metadata to include a reference to the constraint expression, the modified policy attachment metadata indicating that the web service policy should be attached to the policy subject only if the constraint expression is satisfied at runtime of the policy subject.