Access Control speed training

22/22 correct; PB 5.087s→4.115s. Reuse observed shell: ignore shuffled requests and wildcard; IDs fixed A=ada,B=bea,C=cy; 1=repo,2=data. Scan 7 exact policies into six slots; one slot repeats at equal priority, so duplicate conflict→deny; singles use effect. If shell changes, fall back to max-priority then deny ties. Bottleneck: runtime/tool variance.