A computer-implemented method of transforming an attribute-based access control, ABAC, policy to facilitate evaluation in a policy decision point, PDP, of an access request against the ABAC policy, wherein the PDP is communicatively coupled over a communication link to at least one remote attribute source, RAS,, and wherein the ABAC policy comprises hierarchically ordered functional expressions, one or more of the functional expressions having at least one attribute as a subordinate, the value of each attribute being either locally available at the PDP or remotely available in response to a query submitted from the PDP to one of said at least one RAS, wherein at least one value of one of the at least one attribute is remotely available in response to a query submitted from the PDP to one of said at least one RAS, the method being characterized by: identifying, in the ABAC policy, among the hierarchically ordered functional expressions, a first functional expression comprising at least one mathematical operator; forming, on the basis of a sub-hierarchy having said first functional expression as its hierarch, a remote query intended for a first RAS in such manner that output data from execution of the remote query correspond to the outcome of an evaluation of the first functional expression; and transforming the ABAC policy by replacing the sub-hierarchy by a second functional expression (F2; F4) representing the remote query. wherein the PDP is communicatively coupled over a communication link to at least one remote attribute source, RAS,, and wherein the ABAC policy comprises hierarchically ordered functional expressions, one or more of the functional expressions having at least one attribute as a subordinate, the value of each attribute being either locally available at the PDP or remotely available in response to a query submitted from the PDP to one of said at least one RAS, wherein at least one value of one of the at least one attribute is remotely available in response to a query submitted from the PDP to one of said at least one RAS, the method being characterized by: identifying, in the ABAC policy, among the hierarchically ordered functional expressions, a first functional expression comprising at least one mathematical operator; forming, on the basis of a sub-hierarchy having said first functional expression as its hierarch, a remote query intended for a first RAS in such manner that output data from execution of the remote query correspond to the outcome of an evaluation of the first functional expression; and transforming the ABAC policy by replacing the sub-hierarchy by a second functional expression (F2; F4) representing the remote query. identifying, in the ABAC policy, among the hierarchically ordered functional expressions, a first functional expression comprising at least one mathematical operator; forming, on the basis of a sub-hierarchy having said first functional expression as its hierarch, a remote query intended for a first RAS in such manner that output data from execution of the remote query correspond to the outcome of an evaluation of the first functional expression; and transforming the ABAC policy by replacing the sub-hierarchy by a second functional expression (F2; F4) representing the remote query.