Performance impact of sub-groups on repository ACL evaluation

[ron_1]

Does the use of sub-groups impact the performance of ACL evaluation within the repository? For example, say I have an administrators group already pre-defined in LDAP. Does it make a difference if I:

1. explicitly set this LDAP group on the default-domain ACL and remove the original "administrators" group

or

2. define this LDAP group as a subgroup of the original, sql-based "administrators" group and retain this original group on the default-domain ACL