1. A computer-implemented method of constructing a simplified attribute-based access control, ABAC, policy equivalent to a full ABAC policy, comprising: inputting a full ABAC policy comprising a plurality of attribute-dependent expressions, wherein each expression is evaluable to one of Not applicable, Indeterminate and either Permit or Deny; inputting a partial request comprising at least one attribute value and at least one attribute identified as variable; partially evaluating said full ABAC policy by substituting said at least one attribute value for a corresponding attribute appearing in the policy, and forming, based on the evaluation result thus obtained and predetermined simplification rules, a simplified ABAC policy equivalent to the full ABAC policy; and outputting said simplified ABAC policy, wherein said simplified ABAC policy comprises an expression having a result data field for storing said evaluation result.