1. A computer-implemented method of enabling access control, the method comprising: automatically defining an access control statement for an asset, the access control statement comprising a structural expression, a conditional expression and a classification expression; and evaluating the classification expression in the access control statement using an ontology engine.