Query Evaluation in the Presence of Fine-grained Access Control