1. A method of providing access control (AC) in respect of a database storing information in tables and columns and being accessible from a user interface, which is configured to accept a database query and return information extracted from the database, the method being implemented at least in part at a policy enforcement point (PEP), which is located between the database and the user interface, and comprising i) intercepting, at the PEP, a database query; ii) assigning attribute values by performing at least one of the following: ii-a) assigning a resource attribute value based on at least one target table or target column appearing in the query; ii-b) assigning an action attribute value based on a construct type appearing in the query; and ii-c) assigning a subject and/or environment attribute value based on an identity of the user or on environment data; iii) providing an attributed-based AC policy defined in terms of said attributes iv) deriving an access condition, for which the AC policy, when evaluated for the attribute value(s) assigned in step ii), evaluates to permit access; and v) amending the database query by imposing said access condition and vi) transmitting the amended query to the database.
10. The method of claim 1 , further comprising defining a column-to-attribute mapping, wherein: step iv) includes extracting an access condition containing a reference to a non-evaluated attribute; and step v) includes converting, using the column-to-attribute mapping, the reference to a non-evaluated attribute into a reference to at least one column in the database and imposing the access condition after this conversion, for thereby causing the database to substitute information retrieved from said at least one column for the non-evaluated attribute during processing of the amended query.