An approach for implementing policy controls in application programs provides for the execution of code to implement policy constraints in a manner that is generally transparent to application programmers. According to the call redirection approach, routine calls are redirected to a policy broker mechanism. The policy broker mechanism causes one or more policy constraints to be applied and if appropriate, causes the routine targeted by the routine call to be executed. According to the code substitution approach, the code for software application routines for which policy constraints are to be applied is substituted with code that provides for the application of policy controls. The code that performs the original functions may also be maintained, but augmented with additional code to apply policy constraints. Thus, routines normally invoked by application programs, for example, code libraries, do not have to be modified by application programmers to include code to apply policy controls.