Policies of data artifacts and services on the Web restrict the situations in which they are allowed to be used. Compositions, which use several protected entities and are themselves published on the Internet, must obey the restrictions of all relevant policies. Such policies can include restrictions on the policy of the composition, e.g. a service providing sensitive information, can restrict access to compositions republishing the information. We argue in this paper, that it is not sufficient to combine the components' policies and take the result as the policy for the composition. Based on previous work on a suitable policy language, we propose an algorithm for determining the policy of a composition.