A formal approach to analysis and refinement of policies