Policy-based access control in enterprise information system