Non‑Canonical AD ACL Order Can Render Deny ACEs Ineffective
Active Directory evaluates ACL entries sequentially and stops once all required rights are granted. A non‑canonical ACL ordering can let an Allow ACE fire before a Deny ACE, causing the deny to never be evaluated and creating a silent permission bypass.