12. A method comprising: storing a data security policy that comprises a plurality of pairs, each of which is an association between an access control list and a data realm, wherein the plurality of pairs have a first order; in response to receiving a database statement, generating a plurality of authorization results, each of which is a result of applying a privilege associated with the database statement to a different access control list in the plurality of pairs; wherein the plurality of authorization results are ordered based on the first order; wherein each authorization result in the plurality of authorization results is one of a grant, a deny, or a neither grant nor deny; based on the first order, identifying the last grant in the plurality of authorization results; wherein each authorization result, in the plurality of authorization results, that is after the last grant is either a deny or a neither grant nor deny; generating an authorization context for the database statement based on the last grant; storing the authorization context in a cursor for the database statement.
16. The method of claim 12 , wherein the plurality of authorization results is a first plurality of authorization results, wherein the authorization context is a first authorization context, further comprising, after storing the authorization context in the cursor for the database statement: in response to receiving a second database statement, generating a second plurality of authorization results, each of which is a result of applying a privilege associated with the second database statement to a different access control list in the plurality of pairs; wherein the second plurality of authorization results are ordered based on the first order; wherein the second plurality of authorization results is different than the first plurality of authorization results; based on the first order, identifying the last grant in the second plurality of authorization results; generating a second authorization context for the database statement based on the last grant in the second plurality of authorization results; determining whether to use the cursor to execute the second database statement by comparing the second authorization context to the first authorization context.