1. A method, comprising: identifying, in a first query, an expression that identifies a table column that is protected by an access control policy; and creating a second query that is equivalent to the first query as subject to the access control policy; wherein the second query includes an alias that refers to a conditional statement that returns a value from the column only when a condition is satisfied; wherein the method is performed by one or more computing devices.