Runtime-tailored security policies for applications