A computer-implemented method comprising: identifying, in a database system, creation of a derived data entity (134; 408) from an originating data entity (136; 218; 410), the originating data entity associated with an originating access control definition (138; 206), wherein the derived data entity is a database view and the originating data entity is a database view; automatically modifying a data definition of the derived data entity to automatically add an association statement (142; 224; 404) defining an association (224; 412) to the originating entity (136; 216), the association being referred to as a backreference that points back to the originating data entity; automatically creating a derived access control definition (140; 428) by copying the originating access control definition (138; 230); identifying at least one access control condition in the derived access control definition (140; 428), wherein each access control condition includes at least one column reference; automatically creating at least one modified access control condition by modifying each column reference to include a reference (430; 432) to the association to the originating data entity (136; 216; 410), wherein the column references are automatically modified to use the automatically-created backreference; receiving a query for the derived data entity, the query associated with a particular user; automatically creating a modified query by including, in the received query, the at least one modified access control condition (424; 252; 516) and unfolding (512; 514), in the received query, the association to the originating data entity (136; 216; 410), wherein unfolding the association comprises including, in the received query, a join statement that links the derived data entity (408; 508) to the originating data entity and a join statement that handles an association being nested within the association to the originating data entity upon which the derived data entity is based; and executing the modified query (130; 504) including evaluating the at least one modified access control condition (252; 516) to determine records of the derived data entity that are accessible to the particular user, wherein the evaluating includes accessing data of the originating data entity (136; 216; 410). identifying, in a database system, creation of a derived data entity (134; 408) from an originating data entity (136; 218; 410), the originating data entity associated with an originating access control definition (138; 206), wherein the derived data entity is a database view and the originating data entity is a database view; automatically modifying a data definition of the derived data entity to automatically add an association statement (142; 224; 404) defining an association (224; 412) to the originating entity (136; 216), the association being referred to as a backreference that points back to the originating data entity; automatically creating a derived access control definition (140; 428) by copying the originating access control definition (138; 230); identifying at least one access control condition in the derived access control definition (140; 428), wherein each access control condition includes at least one column reference; automatically creating at least one modified access control condition by modifying each column reference to include a reference (430; 432) to the association to the originating data entity (136; 216; 410), wherein the column references are automatically modified to use the automatically-created backreference; receiving a query for the derived data entity, the query associated with a particular user; automatically creating a modified query by including, in the received query, the at least one modified access control condition (424; 252; 516) and unfolding (512; 514), in the received query, the association to the originating data entity (136; 216; 410), wherein unfolding the association comprises including, in the received query, a join statement that links the derived data entity (408; 508) to the originating data entity and a join statement that handles an association being nested within the association to the originating data entity upon which the derived data entity is based; and executing the modified query (130; 504) including evaluating the at least one modified access control condition (252; 516) to determine records of the derived data entity that are accessible to the particular user, wherein the evaluating includes accessing data of the originating data entity (136; 216; 410).