ad-access v0.1.0-beta.2 — Windows effective-access / token evaluator: given a security descriptor and a token, compute resultant access (ordered DACL, deny-before-allow, owner rights, generic mapping,