A logical expression of a policy is generated from another logical expression of a policy, for example, via a set of transformations, each of which comprises an input sub-expression and an output sub-expression. Any sub-expression of the input expression which matches an input sub-expression of a transformation rule is replaced with the output sub-expression of that transformation rule to form a sub-expression of the output expression.