Describing Policies with Graph constraints and rules