1. A method comprising: by a computing device, receiving a request for an object; by the computing device, retrieving one or more access-control rules to evaluate whether to allow or deny access to the object, wherein a first access-control rule from the one or more access-control rules comprises one or more operations, wherein the first access-control rule is configured to be of an allow-type or a deny-type; by the computing device, evaluating the first access-control rule by executing the one or more operations of the first access-control rule, wherein: when any of the executed operations of the first access-control rule returns a result that is not definitive, assigning a final result to the first access-control rule, wherein: (1) if the first access-control rule is configured to be of the allow-type, assigning the final result to the first access-control rule as an indication that evaluation of the access-control rule is to be skipped, and (2) if the access-control rule is configured to be of the deny-type, assigning the final result to the first access-control rule as an indication that access to the object is to be denied; by the computing device, determining one or more final results for the one or more access-control rules; and by the computing device, based on the one or more final results, allowing or denying access to the object.