1. An access control device for controlling access to a data source, comprising: policy storing means for storing a plurality of policies, each policy for controlling access to a part of said data source, when said plurality of policies are inputted; access-determination-tree generating means for generating a plurality of tree-structured data from said plurality of policies; access-determination-tree merging means for merging said plurality of tree-structured data; access-determination-tree storing means for storing the merged tree-structured data; and access determining means for, in response to said access to said part of said data source being attempted, determining from said merged tree-structured data whether or not said access to said part of said data source should be permitted.