A policy management system is described herein that allows an administrator to compose custom policies that can be applied to target devices and that achieve tasks specific to the administrator's organization and network. The composed policies can be standalone policies that are applied independently or sequenced policies that are applied in a specified order. A composed policy may be associated with one or more targets and stored in a policy database. A target device may periodically query the policy management system for any policies that pertain to the target device. If policies have been composed that pertain to the target device and such policies have been updated or have not been previously transmitted to the target device, the policy management system can retrieve the policies from the policy database, merge the policies, and transmit the merged policies to the target device. The target device can then apply the merged policies.