Frankly I forgot whether I asked this before:
Let there be ACLs with dn.regex="..", attrs=foo,bar and
in the <what> clauses.
Obviously depending on complexity of regex-pattern and length of DNs /
avals the regex checking is more expensive than equality checking of attrs=.
Can I improve ACL performance by order of <what> clauses or are they
processed in fixed order anyway? If in fixed order, which one?