A computer-implemented method of provisioning authorization claims, which are enforced to control access of users to objects in a computer system, each authorization claim forming part of a privilege relation associating at least one user, at least one object and at least one permission level, wherein the privilege relation implies access rights of said at least one user to said at least one object on said at least one permission level, the method comprising the steps: i) receiving an attribute-based access control, ABAC, policy represented in a computer readable access control language enabling expressing conditions which depend on external data, depending on attributes and evaluable to one of Permit and possible further values; ii) receiving attribute values for a plurality of elements in predefined categories corresponding to users, objects and permission levels in the computer system; iii) selecting one of the predefined categories as a primary category and partially evaluating the ABAC policy for all elements in the primary category by constructing for each element a partial request comprising values of the attributes of the element but allowing remaining attributes to vary or to be absent or undefined, whereby for each element a primary simplified ABAC policy, represented as a set of logical rules, is obtained as output of the partial evaluation; iv) converting the primary simplified policies to normal form by modifying the respective sets of logical rules representing the simplified ABAC policies to an equivalent representation on disjunctive normal form, conjunctive normal form or other canonical representation, then assessing equality between the primary simplified policies having been converted to normal form, and partitioning the elements in the primary category accordingly into at least one primary equivalence class; viii) selecting one of the predefined categories as a final category and, for a vector comprising one element from each of any remaining non-final category and one of said primary equivalence classes, partially evaluating the ABAC policy to obtain a simplified ABAC policy depending only on attributes of elements in the final category; ix) finding all elements in the final category for which the simplified ABAC policy evaluates to Permit; and x) defining an authorization claim and a privilege relation which associates the primary equivalence class, said one element from each remaining non-final category and the elements in the final category thus found, and encoding the authorization claim for enforcement by the computer system. i) receiving an attribute-based access control, ABAC, policy represented in a computer readable access control language enabling expressing conditions which depend on external data, depending on attributes and evaluable to one of Permit and possible further values; ii) receiving attribute values for a plurality of elements in predefined categories corresponding to users, objects and permission levels in the computer system; iii) selecting one of the predefined categories as a primary category and partially evaluating the ABAC policy for all elements in the primary category by constructing for each element a partial request comprising values of the attributes of the element but allowing remaining attributes to vary or to be absent or undefined, whereby for each element a primary simplified ABAC policy, represented as a set of logical rules, is obtained as output of the partial evaluation; iv) converting the primary simplified policies to normal form by modifying the respective sets of logical rules representing the simplified ABAC policies to an equivalent representation on disjunctive normal form, conjunctive normal form or other canonical representation, then assessing equality between the primary simplified policies having been converted to normal form, and partitioning the elements in the primary category accordingly into at least one primary equivalence class; viii) selecting one of the predefined categories as a final category and, for a vector comprising one element from each of any remaining non-final category and one of said primary equivalence classes, partially evaluating the ABAC policy to obtain a simplified ABAC policy depending only on attributes of elements in the final category; ix) finding all elements in the final category for which the simplified ABAC policy evaluates to Permit; and x) defining an authorization claim and a privilege relation which associates the primary equivalence class, said one element from each remaining non-final category and the elements in the final category thus found, and encoding the authorization claim for enforcement by the computer system.