1. A method of providing access control (AC) in respect of a relational database storing information in tables and columns and being accessible from a user interface, which is configured to accept a database query from a user and return information extracted from the database, the method being implemented at least in part at a policy enforcement point (PEP), which is located between the database and the user interface, and comprising the steps of: i) intercepting, at the PEP, a database query from a user; ii) assigning attribute values by performing at least one of the following substeps: ii-a) assigning a resource attribute value based on at least one target table or target column appearing in the query; ii-b) assigning an action attribute value based on a construct type appearing in the query; and ii-c) assigning a subject and/or environment attribute value based on an identity of the user or on environment data; iii) partially evaluating an attributed-based AC policy defined in terms of said attributes, by constructing a partial policy decision request containing the attribute values assigned in step ii) and evaluating the AC policy for this, whereby a simplified attribute-based AC policy is obtained; iv) deriving an access condition, for which the simplified AC policy evaluates to permit access; and v) amending the database query by imposing said access condition and vi) transmitting the amended query to the database.