18. A method for determining whether a user has access to a requested object, comprising: receiving, at a computing system which includes at least one processor, a request from a user to access a particular file object; accessing an access control metadata element stored on the computing system to determine whether the user is authorized to access the particular file object, comprising: determining that the access control metadata element provides access rights to the particular file object based on a resource scope statement that identifies a plurality of file objects, including the particular file object, for which the access control metadata element provides access rights by defining a portion of a directory hierarchy indicating that the scoped access control metadata element provides access rights for the plurality of file objects, which are located at or below the specified portion of the directory hierarchy, including the particular file object; determining that the access control metadata element provides access rights for the user based on one or more rule statements, the one or more rule statements including: a first rule statement that includes (i) a first statement scope that identifies a first set of one or more users, including the user, to whom the first rule statement applies, the first statement scope including a first rule that defines the first set of one or more users as users that have been authenticated, and (ii) a first grant statement that defines what access rights the first set of one or more users are granted for accessing any one of the plurality of file objects; and a second rule statement that includes (i) a second statement scope that identifies a second set of one or more users to whom the second rule statement applies, and (ii) a second grant statement that defines what different access rights the second set of one or more users are granted for accessing any one of the plurality of file objects; determining that at least the first rule statement grants the user access to the particular file object based on the first statement scope and the first grant statement; and upon determining that the first rule statement grants the user access to the particular file object, and upon determining that the particular file object is within the plurality of file objects identified by the resource scope statement, granting the user access to the particular file object in accordance with the first grant statement defined in the first rule statement of the access control metadata element.
21. The method of claim 18 , wherein the rules statement contains references the one or more rule statements, such that the rules are not directly contained within the rules statement.