1. A computer-implemented method of evaluating an attribute-based access control, ABAC, policy for a set of elements, which are arranged in a computer system and belong to one of several predefined categories selected from subjects, resources, actions and environments, wherein the access control policy comprises functional expressions which depend on attributes, each pertaining to elements in one of several predefined categories, each element in the set being associated with at least one attribute value assumed by an attribute of the element, and wherein the policy controls access of subjects in the set of elements to resources in the set of elements in accordance with values of the policy, including Permit and Deny, the method comprising the steps of: i) selecting one of the predefined categories as a primary category; ii) for the selected category, performing the substeps of: ii-1) extracting, from the policy, expressions containing attributes in no other than the selected category; ii-2) extracting, from elements in the category, values assumed by the attributes appearing in the extracted expressions; ii-3) evaluating the extracted expressions for the extracted values and partitioning the elements in the primary category accordingly into at least one primary equivalence class; vi) for an arbitrary vector comprising one element from each remaining category and an arbitrary one of said primary equivalence classes, performing the substeps of: vi-2) evaluating the policy for a combination of the vector and an arbitrary element in the primary equivalence class; and vi-3) deducing a value of the policy for a combination of the vector and a further element in the primary equivalence class.