Security policies are the key to the security of information systems.It is the precondition for the security of information systems to assure the completeness

correctness and consistency of security policies.The complexity of security policies is closely related to the degree of complexity of a system itself.Security policies must be enforced effectively.The following is studied in this paper:the enforcement of policies

the requirement for policies

and the consistency of policies.Especially a theorem is given for the consistency of access control policies and a method used to check the consistency is presented.