We present an approach based on roles and access policies to improve security management of Web Applications. The approach first identifies the roles users have in the application, and then the software resources they can access based on the assigned role. Roles and resources are then used to design access policies by means of a visual language based tool providing a metaphor oriented layer above the well known Role Based Access Control (RBAC) model. A network infrastructure based on a Policy Enforcement Point (PEP) and a Policy Decision Point (PDP) is used to enforce these policies. The proposed approach has been used in a preliminary case study.