docs: private RoleSet findRolesForAccessId(String accessId) {
  
          if (!AccessIdUtil.isAccessId(accessId)) {
              throw new IllegalArgumentException("Invalid accessId");
          }
  
          if (AccessIdUtil.isUserAccessId(accessId)) {
              // An user can be configured as user or an user-access-Id
              // Ex: bob or user:realm/bob
              for (String user : userToRoles.keySet()) {
                  String userAccessId = userToAccessId.get(user);
                  if (userAccessId == null) {
                      if (AccessIdUtil.isUserAccessId(user)) {
                          userAccessId = user;
                      } else {
                          // user is not accessId format, so we have to look up the user registry.
                          userAccessId = getUserAccessId(user);
                          if (userAccessId == null) {
                              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                                  Tr.debug(tc, "Unable to determine accessId of user " + user);
                              }
                              // We could not determine the access ID here, skip
                              // For all unknown IDs we try to re-compute each time
                              // we see it. This is probably the right thing to do
                              // as the user could add that entry in the future.
                              continue;
                          }
                      }
                      userToAccessId.put(user, userAccessId);
                  }
                  if (accessIdToRoles.get(userAccessId) == null) {
                      accessIdToRoles.put(userAccessId, userToRoles.get(user));
                  }
                  if (isMatch(accessId, userAccessId)) {
                      return accessIdToRoles.get(userAccessId);
                  }
              }
          } else if (AccessIdUtil.isGroupAccessId(accessId)) {
              // A group can be configured as a group or group-access-id
              // Ex: group1 or group1:realm/group1
              for (String group : groupToRoles.keySet()) {
                  String groupAccessId = groupToAccessId.get(group);
                  if (groupAccessId == null) {
  
                      if (AccessIdUtil.isGroupAccessId(group)) {
                          groupAccessId = group;
                      } else {
                          // group is not accessId format, so we have to look up the user registry.
                          groupAccessId = getGroupAccessId(group);
                          if (groupAccessId == null) {
                              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                                  Tr.debug(tc, "Unable to determine accessId of group " + group);
                              }
                              // We could not determine the access ID here, skip
                              // For all unknown IDs we try to re-compute each time
                              // we see it. This is probably the right thing to do
                              // as the user could add that entry in the future.
                              continue;
                          }
                      }
                      groupToAccessId.put(group, groupAccessId);
                  }
                  if (accessIdToRoles.get(groupAccessId) == null) {
                      accessIdToRoles.put(groupAccessId, groupToRoles.get(group));
                  }
                  if (isMatch(accessId, groupAccessId)) {
                      return accessIdToRoles.get(groupAccessId);
                  }
              }
          } else {
              // Do nothing
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "Unknown accessId");
              }
              return RoleSet.EMPTY_ROLESET;
          }
  
          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
              Tr.debug(tc, "No roles mapped to accessId", accessId);
          }
          return RoleSet.EMPTY_ROLESET;
      }