A method for secure policies-based information governance, the method comprising: displaying a Graphical User Interface, GUI, the GUI receiving a business rule input from a business user; receiving a policy from a policy engine based on the business rule input, the policy engine generating a policy hierarchy that allows precedence of policies operation, the policy hierarchy allowing the concept of guardrails to ensure that potentially dangerous policy actions may be controlled; defining a plurality of domain objects and a plurality of domain object representations in the GUI based on the policy and the policy hierarchy; defining an extensible hierarchical domain model definition using the policy hierarchy, the extensible hierarchical domain model definition being modified using the plurality of domain object representations in the GUI; defining a Policy Enforcement Point, PEP in an application based on the extensible hierarchical domain model definition; providing a mapping from the PEP in the application to the plurality of domain object representations in the GUI; receiving, by the PEP, a user request to access a resource on the application, the user request comprising attributes of the business user; sending, by the PEP, the user request to access the resource on the application to a Policy Decision Point, PDP; evaluating, by the PDP, the user request to access the resource on the application, the evaluating using the extensible hierarchical domain model definition; generating, by the PDP, a decision regarding the user request to access the resource on the application based on the evaluating; and enforcing, by the PEP, the decision regarding the user request to access the resource on the application. displaying a Graphical User Interface, GUI, the GUI receiving a business rule input from a business user; receiving a policy from a policy engine based on the business rule input, the policy engine generating a policy hierarchy that allows precedence of policies operation, the policy hierarchy allowing the concept of guardrails to ensure that potentially dangerous policy actions may be controlled; defining a plurality of domain objects and a plurality of domain object representations in the GUI based on the policy and the policy hierarchy; defining an extensible hierarchical domain model definition using the policy hierarchy, the extensible hierarchical domain model definition being modified using the plurality of domain object representations in the GUI; defining a Policy Enforcement Point, PEP in an application based on the extensible hierarchical domain model definition; providing a mapping from the PEP in the application to the plurality of domain object representations in the GUI; receiving, by the PEP, a user request to access a resource on the application, the user request comprising attributes of the business user; sending, by the PEP, the user request to access the resource on the application to a Policy Decision Point, PDP; evaluating, by the PDP, the user request to access the resource on the application, the evaluating using the extensible hierarchical domain model definition; generating, by the PDP, a decision regarding the user request to access the resource on the application based on the evaluating; and enforcing, by the PEP, the decision regarding the user request to access the resource on the application.