11. An access-controlled database system comprising a policy enforcement point (PEP) for providing access control (AC) in respect of a relational database storing information in tables and columns, the PEP being adapted to be located between the database and a user interface, which is configured to accept a database query from a user and return information extracted from the database, and the PEP comprising the following communicatively connected sections: a communication interface for intercepting a database query; and attribute evaluating means for assigning attribute values by performing one of the following: a) assigning a resource attribute value based on at least one target table or target column in the query; b) assigning an action attribute value based on a construct type in the query; and c) assigning a subject and/or environment attribute value based on at least an identity of the user or on environment data, wherein the communication interface is further adapted to transmit an amended query, resulting from imposing an access condition derived from an attribute-based AC policy on the basis of attribute values provided by the attribute evaluating means, to the database.
14. The system of claim 11 , wherein the PEP further comprises query modifying means for amending the database query intercepted by the communication interface by imposing said access condition.