1. A computer-implemented method comprising steps of: receiving a query expression associated with a first principal and against data stored in one or more tables of a database, wherein at least one of the one or more tables is associated with one or more data realms of a data access control policy; wherein each data realm of the one or more data realms comprises an access predicate and at least one list of entries, wherein the access predicate specifies one or more rows to which the at least one list of entries is applicable, and wherein each entry of said at least one list of entries maps one or more principles to one or more privileges granted or denied to said one or more principles; rewriting the query expression to form a first rewritten query expression, wherein the first rewritten query expression includes an access check query operator that specifies the one or more data realms as parameters; determining, based on the first principal and the one or more data realms, that one or more particular access predicates of the one or more data realms are associated with the first principal; and in response to determining that the one or more particular access predicates are associated with the first principal, rewriting the first rewritten query expression to form a second rewritten query expression, wherein the second rewritten query expression comprises the one or more particular access predicates associated with the first principal outside of the access check query operator; and wherein the method is performed by one or more computing devices.