To integrate security into middleware, the middleware must provide appropriate hooks and interfaces and meet the security architecture?s requirements. In most cases, modifying existing systems is more practical than developing new, secure middleware from scratch. Corba component-based middleware and a policy management framework are successfully integrated to define, manage, and enforce security policies by defining container portable interceptors and QoS enablers. An experimental secure air traffic control system serves as a test case to practically evaluate the concepts.