> the second one hits an in-memory cache if the second request involves the same subject, or at least subject:resource combo if the second request matches the resource, permission and subject exactly (and consistency request), then we use the cached result immediately