1. A computer-implemented method comprising steps of: receiving a query expression associated with a first principal and against data stored in one or more tables of a database, wherein at least one of the one or more tables is subject to a data access control policy; wherein the data access control policy comprises one or more data realms, wherein each data realm comprises an access predicate and at least one list of entries, each entry of said at least one list of entries mapping more principles to one or more privileges ranted or denied to said one or more principles; determining, based on the first principal and the one or more data realms, one or more access predicates associated with the first principal; and in response to determining the one or more access predicates associated with the first principal, rewriting the query expression to form a rewritten query expression, wherein the rewritten query expression comprises the one or more access predicates associated with the first principal; and wherein the method is performed by one or more computing devices.