Role-based access control (RBAC) models specify a policy interface for security administration, but do not provide guidelines for how large organisations should manage their roles. Parameterised RBAC systems are even more expressive; however, this adds to the risk of dangerous mistakes during policy specification. In this paper we define a formal model for hierarchical policy contexts: an RBAC meta-policy approach for subdividing the administration of large-scale security environments and for enforcing information flow restrictions over policies.