For access to low-level security software applications, if the password is authentic, the policy server then proceeds to determine whether access should be authorized based on user, site, system, contract and other information and business rules (i.e., community definitions) in the community management database.