1. A method comprising: by a computing device, receiving a request for an object; by the computing device, retrieving an access-control rule to evaluate whether to allow or deny access to the object, wherein the access-control rule comprises one or more operations, wherein each of the operations is determined to be either necessary or unnecessary for evaluation of the access-control rule; by the computing device, evaluating the access-control rule by executing the one or more operations of the access-control rule, wherein: when a first executed operation of the access-control rule returns a result that is not definitive and a second executed operation returns a result that is definitive, assigning a final result to the access-control rule, wherein: (1) if the first executed operation is determined to be unnecessary for evaluation of the access-control rule, disregarding the result of the first executed operation and assigning as the final result to the access-control rule a value based on the result of the second executed operation, and (2) if the first executed operation is determined to be necessary for evaluation of the access-control rule, assigning as the final result to the access-control rule a value indicating that access to the object is to be denied; and by the computing device, based on the final result, allowing or denying access to the object.