The paper presents a monitoring framework for WS-BPEL processes. It proposes WS-CoL (Web Service Constraint Language) as a domain-independent language, compliant with the WS-Policy framework, for specifying user requirements (constraints) on the execution of Web service compositions. WS-Policy and WS-CoL provide a uniform framework to accommodate both functional and non-functional constraints, even though the paper only addresses non-functional requirements. It concentrates on security, which is one of the most challenging QoS dimensions for this class of applications.