Ordering of Security Assertions

On the 9/19 WS-Policy Telcon Maryann Hondo said in the context of 
processing WS-Policy assertions:

maryann: security policy says: they have to be the first one in
   processing on the way in , and the last one on the way out


Seems reasonable, but I cannot find where in the spec it says that.
Can anyone tell me? One of the authors can probably quote it off of
the top of their head.
-- 
All the best, Ashok