Abstract: Access control is performed in an information technology system comprising a normalized access control database and a denormalized access control database. In response to an update request from a client to change the access rights of a higher hierarchy level entity, the access rights of the higher hierarchy level entity are updated in the normalized database. Furthermore, updated access control rights for one or more corresponding lower hierarchy level entities related to the higher hierarchy level entity are computed and stored in a denormalized database. An access request from one of the one or more lower hierarchy level entities is served on the basis of the updated access rights at the lower hierarchy level stored in the denormalized database.