1. A method, performed by one or more computing devices, comprising: by a computing device, receiving a request for an object; by the computing device, retrieving one or more access-control rules to evaluate whether to allow or deny access to the object, wherein each of the access-control rules comprises one or more operations, and wherein each of the access-control rules is configured to be of an allow-type or a deny-type; by the computing device, evaluating at least one of the access-control rules by executing the operations for the access-control rule, wherein: when a specific one of the executed operations returns a predetermined result, wherein the predetermined result comprises a value representing true or false, skipping execution of any unexecuted operations for the access-control rule and assigning a final result to the access-control rule based on the predetermined result; and when any of the executed operations returns a result that is not definitive, (1) if the access-control rule is configured to be of the allow-type, assigning the final result as an indication that evaluation of the access-control rule is to be skipped and (2) if the access-control rule is configured to be of the deny-type, assigning the final result as an indication that access to the object is to be denied; by the computing device, determining the final results of the access-control rules; and by the computing device, based on the final results, allowing or denying access to the object.