1. A method, comprising: identifying a first expression in a first predicate of a first query, wherein the first expression identifies a column of a table, wherein the column stores one or more values in a database system, and wherein access to the one or more values in the column is protected by an access control policy; and creating a second query that is equivalent to the first query as subject to the access control policy, wherein the second query has a second predicate that conjunctively joins a clone of the first expression with a second expression derived, based on the access control policy, from the first expression; wherein the second expression includes an alias that has a same name as the column but which refers to a conditional statement that returns a value from the column when a condition is satisfied but returns null when the condition is not satisfied; wherein the clone of the first expression preserves hints for query optimization so that a query optimizer can take advantage of an existing index on the column; wherein the method is performed by one or more computing devices.