Storage and privacy service

1. A method comprising:

storing access control code defining access control rules applied to a plurality of nodes in a graph, the graph comprising the plurality of nodes and one or more edges, and the plurality of nodes comprising:

a first node representing a user,

a second node representing an object linked to the user by an edge of the one or more edges, and

a third node representing one or more of the access control rules associated with at least one of the user and the object, the third node further representing:

code defining each of the access control rules as a set of operations, wherein each operation for an access control rule returns (1) when the operation is resolved, a predetermined result, wherein the predetermined result comprises a value representing a true or a false value, and (2) when the operation is not resolved, a not definitive result, wherein the not definitive result is an indication that the operation should be skipped if the operation is not necessary for determining the access control rule;

compiling the access control code;

loading the compiled access control code for execution;

receiving a query for the object;

executing the compiled access control code to evaluate, for one of the access control rules, the corresponding set of operations that have not been skipped;

determining, for each of the one or more access control rules, a rule-result comprising a value representing a true or a false value;

determining a final result based on the one or more rule-results of the one or more access control rules, the final result indicating an allow-result or a deny-result; and

sending the object when the final result evaluates to an allow-result.

2. The method of claim 1 , wherein the code defining each of the access control rules is strictly typed.

3. The method of claim 1 , wherein the compiled access control code is stored as a .so file.

4. The method of claim 1 , wherein the compiled access control code is loaded into a server shell for execution.

5. The method of claim 1 , wherein a first operation and a second operation of a particular rule are evaluated in parallel.

6. The method of claim 5 , wherein the second operation is skipped if the first operation is resolved first and returns a predetermined result that renders the second operation unnecessary.

7. A system comprising: one or more processors; and a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to:

store access control code defining access control rules applied to a plurality of nodes in a graph, the graph comprising the plurality of nodes and one or more edges, and the plurality of nodes comprising:

a first node representing a user,

a second node representing an object linked to the user by an edge of the one or more edges, and

a third node representing one or more of the access control rules associated with at least one of the user and the object, the third node further representing:

code defining each of the access control rules as a set of operations, wherein each operation for an access control rule returns (1) when the operation is resolved, a predetermined result, wherein the predetermined result comprises a value representing a true or a false value, and (2) when the operation is not resolved, a not definitive result, wherein the not definitive result is an indication that the operation should be skipped if the operation is not necessary for determining the access control rule;

compile the access control code;

load the compiled access control code for execution;

receive a query for the object;

execute the compiled access control code to evaluate, for one of the access control rules, the corresponding set of operations that have not been skipped;

determine, for each of the one or more access control rules, a rule-result comprising a value representing a true or a false value;

determine a final result based on the one or more rule-results of the one or more access control rules, the final result indicating an allow-result or a deny-result; and

send the object when the final result evaluates to an allow-result.

8. The system of claim 7 , wherein the code defining each of the access control rules is strictly typed.

9. The system of claim 7 , wherein the compiled access control code is stored as a .so file.

10. The system of claim 7 , wherein the compiled access control code is loaded into a server shell for execution.

11. The system of claim 7 , wherein a first operation and a second operation of a particular rule are evaluated in parallel.

12. The system of claim 11 , wherein the second operation is skipped if the first operation is resolved first and returns a predetermined result that renders the second operation unnecessary.

13. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

store access control code defining access control rules applied to a plurality of nodes in a graph, the graph comprising the plurality of nodes and one or more edges, and the plurality of nodes comprising:

a first node representing a user,

a second node representing an object linked to the user by an edge of the one or more edges, and

a third node representing one or more of the access control rules associated with at least one of the user and the object, the third node further representing:

code defining each of the access control rules as a set of operations, wherein each operation for an access control rule returns (1) when the operation is resolved, a predetermined result, wherein the predetermined result comprises a value representing a true or a false value, and (2) when the operation is not resolved, a not definitive result, wherein the not definitive result is an indication that the operation should be skipped if the operation is not necessary for determining the access control rule;

compile the access control code;

load the compiled access control code for execution;

receive a query for the object;

execute the compiled access control code to evaluate, for one of the access control rules, the corresponding set of operations that have not been skipped;

determine, for each of the one or more access control rules, a rule-result comprising a value representing a true or a false value;

determine a final result based on the one or more rule-results of the one or more access control rules, the final result indicating an allow-result or a deny-result; and

send the object when the final result evaluates to an allow-result.

14. The media of claim 13 , wherein the code defining each of the access control rules is strictly typed.

15. The media of claim 13 , wherein the compiled access control code is stored as a .so file.

16. The media of claim 13 , wherein the compiled code is loaded into a server shell for execution.

17. The media of claim 13 , wherein a first operation and a second operation of a particular rule are evaluated in parallel.

18. The media of claim 17 , wherein the second operation is skipped if the first operation is resolved first and returns a predetermined result that renders the second operation unnecessary.