Optimizing a policy authoring framework for security and privacy policies