A method comprising: receiving, by a network computing device, a network access request from a first user and a requested rule group comprising one or more requested rules associated with the first user; querying, by the network computing device, a bit matrix that indicates one or more associations between one or more existing rule groups and one or more existing rules stored on the network computing device that are currently deployed within a forwarding plane of the network computing device to select an existing rule group as a candidate rule group associated with a packet flow, wherein the candidate rule group references one or more currently deployed rules of the existing rule group on the network computing device that are being applied by the forwarding plane of the network computing device to network traffic associated with a second user; installing, by the network computing device and based on the candidate rule group, a new rule group that includes references to one or more currently deployed rules of the existing rule group and one or more new rules associated with the first user and not currently installed within the forwarding plane of the network computing device, wherein one or more requested rules of the requested rule group comprise rules of the new rule group; installing, by the network computing device, the one or more new rules associated with the first user within the forwarding plane of the network computing device; and applying, by the network computing device, each rule of the new rule group to network traffic associated with the first user, wherein applying each rule of the new rule group includes applying the one or more new rules of the new rule group and the one or more existing rules referenced by the new rule group that are being applied by the forwarding plane to the network traffic associated with the second user. receiving, by a network computing device, a network access request from a first user and a requested rule group comprising one or more requested rules associated with the first user; querying, by the network computing device, a bit matrix that indicates one or more associations between one or more existing rule groups and one or more existing rules stored on the network computing device that are currently deployed within a forwarding plane of the network computing device to select an existing rule group as a candidate rule group associated with a packet flow, wherein the candidate rule group references one or more currently deployed rules of the existing rule group on the network computing device that are being applied by the forwarding plane of the network computing device to network traffic associated with a second user; installing, by the network computing device and based on the candidate rule group, a new rule group that includes references to one or more currently deployed rules of the existing rule group and one or more new rules associated with the first user and not currently installed within the forwarding plane of the network computing device, wherein one or more requested rules of the requested rule group comprise rules of the new rule group; installing, by the network computing device, the one or more new rules associated with the first user within the forwarding plane of the network computing device; and applying, by the network computing device, each rule of the new rule group to network traffic associated with the first user, wherein applying each rule of the new rule group includes applying the one or more new rules of the new rule group and the one or more existing rules referenced by the new rule group that are being applied by the forwarding plane to the network traffic associated with the second user.