A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control policy, ABAC policy, which is enforced to control access to one or more resources in a computer network, said method comprising the steps of: i) receiving a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set of access requests, each of which comprises one or more attributes appearing in the ABAC policy and explicit values assigned to these; ii) extracting attributes to which all access requests in the set assign identical values; iii) reducing the ABAC policy at least by substituting values for the extracted attributes; iv) caching the policy after said reducing as a simplified policy (P'); v) translating the cached simplified policy (P') and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i, i = 1, 2,...) by either representing at least part of the simplified policy (P') as a binary decision diagram or representing the simplified policy (P') with a tree structure and replacing, whenever a sub-tree in the tree structure represents a Boolean expression that compares an attribute with a fixed value and/or a Boolean expression having at least one child evaluating to a non-Boolean value, replacing said sub-tree by a variable (v i); vi) deriving all variable assignments (c j = [v 1 = x j1, v 2 = x j2,...], j = 1, 2,...) satisfying the logic proposition, in case the simplified policy (P') is represented as a binary decision diagram, by deriving all paths in the binary decision diagram evaluating to either true or false, or, in case the simplified policy (P') is represented as a tree structure, by means of a SAT solver; and vii) assessing, for each access request (r) in the set, whether it corresponds to any of the variable assignments satisfying the logic proposition and, if does, extracting this access request. i) receiving a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set of access requests, each of which comprises one or more attributes appearing in the ABAC policy and explicit values assigned to these; ii) extracting attributes to which all access requests in the set assign identical values; iii) reducing the ABAC policy at least by substituting values for the extracted attributes; iv) caching the policy after said reducing as a simplified policy (P'); v) translating the cached simplified policy (P') and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i, i = 1, 2,...) by either representing at least part of the simplified policy (P') as a binary decision diagram or representing the simplified policy (P') with a tree structure and replacing, whenever a sub-tree in the tree structure represents a Boolean expression that compares an attribute with a fixed value and/or a Boolean expression having at least one child evaluating to a non-Boolean value, replacing said sub-tree by a variable (v i); vi) deriving all variable assignments (c j = [v 1 = x j1, v 2 = x j2,...], j = 1, 2,...) satisfying the logic proposition, in case the simplified policy (P') is represented as a binary decision diagram, by deriving all paths in the binary decision diagram evaluating to either true or false, or, in case the simplified policy (P') is represented as a tree structure, by means of a SAT solver; and vii) assessing, for each access request (r) in the set, whether it corresponds to any of the variable assignments satisfying the logic proposition and, if does, extracting this access request.