ad-access

Windows effective-access / token evaluator: given a security descriptor and a token, compute resultant access (ordered DACL, deny-before-allow, owner rights, generic mapping, conditional ACEs, mandatory integrity, inheritance flags, object-type ACEs). Validated 42/42 against Windows AuthzAccessCheck. Zero dependencies.