1. A method, comprising: identifying a first expression in a first predicate of a first query that is subject to an access control policy, wherein the first expression identifies a column of a table, wherein the column stores one or more values in a database system, and wherein access to the one or more values in the column is protected by the access control policy; and creating a second query that is equivalent to the first query as subject to the access control policy, wherein the second query has a second predicate that conjunctively joins a clone of the first expression with a second expression derived, based on the access control policy, from the first expression.