An Enhanced CFA for Security Policies