19. A computer system for controlling access to structured documents, the computer system comprising: a database management system implemented on the computer system; the data management system including a processor for executing instructions on the computer system, the database management system comprising: an access control policy for a structured document, wherein the structured document comprises a plurality of nodes and the access control policy comprises a plurality of access control rules, and an access control mechanism configured to: generate a path for each of the plurality of nodes in the structured document and generate an executable value expression for each path by normalizing the plurality of access control rules into a format comprising a head, a path, and a condition that indicates who is granted or denied access to each path, generating and populating a condition table to convert the plurality of normalized access control rules into a plurality of modified normalized access control rules, propagating the plurality of modified normalized access control rules for each generated path to identify at least one generated path that is affected by at least one of the plurality of modified normalized access control rules, combining at least two modified normalized access control rules of the plurality of modified normalized access control rules if the at least two modified normalized access control rules affect a particular generated path, optimizing the plurality of modified normalized access control rules by eliminating repeated value expressions, and transforming the plurality of modified normalized access control rules into the executable value expression for each path based on the condition, wherein the executable value expression is utilized during access control evaluation to determine whether a user is allowed to access at least one of the plurality of nodes in the structured document.
24. The computer system of claim 19 , wherein the access control mechanism comprises: a translator propagating each of the plurality of access control rules through each path such that access to each path is defined by at least one access control rule; and a value expression generator for transforming each of the at least one access control rules associated with each path into a statement indicating who is granted and denied access to the path.