1. A method comprising: receiving, by a computing device, a network access request from a first user; selecting, by the computing device, a candidate rule group associated with the packet flow, wherein the candidate rule group comprises one or more currently deployed rules of an existing rule group on the computing device that are currently installed within a forwarding plane of the computing device and are being applied by the forwarding plane of the computing device to network traffic associated with a second user; installing, by the computing device, a new rule group comprising the one or more currently deployed rules of the existing rule group and one or more new rules associated with the first user and not currently installed within the forwarding plane of the computing device; and applying, by the computing device, each rule of the new rule group to network traffic associated with the first user.