1. A method of controlling access using centrally managed rules comprising: providing rules, wherein the rules are stored in a rules database maintained by a central rule server, the rules of the rules database comprises a conditional statement having a policy abstraction and a corresponding action that will be performed when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored in a definition statement database, different than the rules database; and transferring a first subset of rules stored in the rules database to a client system, wherein the first plurality of rules transferred to the client system contain at least one expression used by the client system to perform access control for documents accessed by the client system.