14. The computer-readable medium of claim 11 , wherein generating derived user groups includes analyzing each rule in the complex rule set, and a relative precedence of each rule, to identify original user groups that have the same grant or denial to each electronic document.
11. A non-transitory computer-readable medium encoded with executable instructions that, when executed, cause one or more data processing systems to: receive a complex rule set corresponding to at least one electronic document, the complex rule set including a combination of granting rules, denying rules, and rule precedence; generate derived user groups according to the complex rule set; identify derived grant groups that correspond to members of original user groups that are granted access to the electronic document by a grant rule of the complex rule set, excluding members of the original user groups that were denied access to the electronic document by a higher-precedence deny rule of the complex rule set; derive grant rules for each electronic document according to the complex rule set to produce a derived grant rule set, wherein the derived grant rule set has a derived grant rule for each grant rule in the complex rule set, and does not have derived grant rules for any deny rule in the complex rule set; and store the derived grant rules as associated with the electronic document.