15. The method of claim 14 , wherein step iii includes the processor in the PDP assigning an access decision in response to the received output data resulting from the execution of the remote query and propagating the access decision into the subsequent evaluation of the access request, the access decision preferably being one of: Permit, Deny.
14. A computer-implemented method of evaluating an access request against an attribute-based access control (ABAC) policy, wherein the method is implemented in a policy decision point (PDP), which is communicatively coupled over a communication link to at least one remote attribute source (RAS), and wherein the ABAC policy comprises hierarchically ordered functional expressions, each functional expression having at least one other functional expression and/or at least one attribute as a subordinate, the value of each attribute being either locally available at the PDP or remotely available in response to a query submitted from the PDP to one of said at least one RAS, the method comprising: i) a processor in the PDP receiving an access request intended for an ABAC policy; ii) the processor in the PDP obtaining a transformed ABAC policy equivalent to said ABAC policy, the transformed ABAC policy comprising at least one functional expression representing a remote query to one of said at least one RAS; and iii) the processor in the PDP initiating evaluation of the access request against the transformed ABAC policy, including generating, in response to encountering said functional expression, the remote query to said one RAS, executing the query and receiving output data resulting from the execution, wherein the received output data are propagated into the subsequent evaluation of the access request.