1. A computer-implemented method of evaluating an attribute-based access control (ABAC) policy for a set of elements in a computer system, wherein each element belongs to exactly one of several predefined categories, wherein the access control policy comprises functional expressions which depend on attributes, elements in the set being associated with attribute values assumed by attributes of the respective elements, the method comprising: i) selecting one of the predefined categories as a primary category; ii) for the selected category, performing the substeps of: ii-1) extracting expressions from the policy, wherein the extraction is limited to expressions in which any attributes are associated only with elements belonging to the selected category; ii-2) extracting, from elements in the selected category, values assumed by the attributes appearing in the extracted expressions; ii-3) evaluating the extracted expressions for the extracted values and partitioning the elements in the primary category accordingly into at least one primary equivalence class; vi) for an arbitrary vector comprising one element from each remaining category and an arbitrary one of said primary equivalence classes, performing the substeps of: vi-2) evaluating the policy for a combination of the vector and an arbitrary element in the primary equivalence class, yielding a value of the policy; vi-3) deducing, from said value of the policy, a further value of the policy for a combination of the vector and a further element in the primary equivalence class; vii) encoding the result of the evaluation as a second data record representing results of the evaluation of the ABAC policy as policy decisions associated with n-tuples of elements; and viii) storing the second data record.