First, a myth to kill: "the ACL model is slower than an owned AdminCap because the access list lives in a shared object, and shared objects serialize."
Not for permission checks. A role lookup only reads the list. In OZ's AccessControl, the signature is literally has_role(ac: &AccessControl, ...) — &, not &mut.