Usable Formal Methods for the Design and Composition of Security and Privacy Policies