docs: private RoleSet findRolesForAccessId(String accessId) {
  
          if (!AccessIdUtil.isAccessId(accessId)) {
              throw new IllegalArgumentException("Invalid accessId");
          }
  
          if (AccessIdUtil.isUserAccessId(accessId)) {
              // First look for any <user> WITHOUT an explicit access id
              for (String user : userToRoles.keySet()) {
                  String userAccessId = userToAccessId.get(user);
                  if (userAccessId == null) {
                      userAccessId = getUserAccessId(user);
                      if (userAccessId == null) {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                              Tr.debug(tc, "Unable to determine accessId of user " + user);
                          }
                          // We could not determine the access ID here, skip
                          // For all unknown IDs we try to re-compute each time
                          // we see it. This is probably the right thing to do
                          // as the user could add that entry in the future.
                          continue;
                      }
                      userToAccessId.put(user, userAccessId);
                  }
                  if (getRoleSet(accessIdToRoles, userAccessId) == null) {
                      accessIdToRoles.put(userAccessId, new RoleSet(userToRoles.get(user), getRoles(explicitAccessIdToRoles, userAccessId)));
                  }
                  if (isMatch(accessId, userAccessId)) {
                      return getRoleSet(accessIdToRoles, userAccessId);
                  }
              }
              // This access id was not for any <user> WITHOUT an explicit access id
              // See if there was a <user> with this explicit access id specified
              Set<String> explicitRoleSet = getRoles(explicitAccessIdToRoles, accessId);
              if (explicitRoleSet != null) {
                  RoleSet set = new RoleSet(explicitRoleSet);
                  accessIdToRoles.put(accessId, set);
                  return set;
              }
          } else if (AccessIdUtil.isGroupAccessId(accessId)) {
              // First look for any <group> WITHOUT an explicit access id
              for (String group : groupToRoles.keySet()) {
                  String groupAccessId = groupToAccessId.get(group);
                  if (groupAccessId == null) {
                      groupAccessId = getGroupAccessId(group);
                      if (groupAccessId == null) {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                              Tr.debug(tc, "Unable to determine accessId of group " + group);
                          }
                          // We could not determine the access ID here, skip
                          // For all unknown IDs we try to re-compute each time
                          // we see it. This is probably the right thing to do
                          // as the user could add that entry in the future.
                          continue;
                      }
                      groupToAccessId.put(group, groupAccessId);
                  }
                  if (getRoleSet(accessIdToRoles, groupAccessId) == null) {
                      accessIdToRoles.put(groupAccessId, new RoleSet(groupToRoles.get(group), getRoles(explicitAccessIdToRoles, groupAccessId)));
                  }
                  if (isMatch(accessId, groupAccessId)) {
                      return getRoleSet(accessIdToRoles, groupAccessId);
                  }
              }
              // This access id was not for any <group> WITHOUT an explicit access id
              // See if there was a <group> with this explicit access id specified
              Set<String> explicitRoleSet = getRoles(explicitAccessIdToRoles, accessId);
              if (explicitRoleSet != null) {
                  RoleSet set = new RoleSet(explicitRoleSet);
                  accessIdToRoles.put(accessId, set);
                  return set;
              }
          } else {
              // Do nothing
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "Unknown accessId");
              }
              return RoleSet.EMPTY_ROLESET;
          }
  
          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
              Tr.debug(tc, "No roles mapped to accessId", accessId);
          }
          return RoleSet.EMPTY_ROLESET;
      }