1. A method comprising: receiving, by a computing device, a network access request from a first user; querying a data structure that indicates one or more associations between an existing rule group and one or more existing rules that are currently deployed within a forwarding plane of the computing device to select, by the computing device, a candidate rule group associated with a packet flow, wherein the candidate rule group references one or more of the one or more existing rules that are being applied by the forwarding plane of the computing device to network traffic associated with a second user; installing, by the computing device and based on the candidate rule group, a new rule group that includes references to one or more of the one or more existing rules of the candidate rule group and one or more new rules associated with the first user and not currently installed within the forwarding plane of the computing device; installing, by the computing device, the one or more new rules associated with the first user within the forwarding plane of the computing device; and applying, by the computing device, each rule of the new rule group to network traffic associated with the first user, wherein applying each rule of the new rule group includes applying the one or more new rules of the new rule group and the one or more existing rules referenced by the new rule group that are being applied by the forwarding plane to the network traffic associated with the second user.