# Evaluate Ordered Access-Control Rules Evaluate access-control rules in insertion order. Each rule is ACTION if EXPRESSION, where ACTION is ACCEPT or BLOCK. An expression contains boolean identifiers or integer comparisons joined by AND and OR; AND has higher precedence. Return the action of the first matching rule. ### Function Signature ```text evaluate_access_rules(rules: list[str], facts: list[list[str]]) -> str ``` ### Valid Input Domain Every fact is [name, value], names are unique identifiers, and values are either true, false, or a base-10 integer encoded as text. Every referenced fact exists with the required type. Rules use spaces between tokens, contain no parentheses, and comparisons use one of >, >=, <, <=, ==, or != followed by an integer literal. ### Exact Output Semantics Evaluate boolean identifiers by their fact value and numeric comparisons as signed 64-bit integers. Evaluate AND before OR. Scan rules from first to last and return the first matching ACTION exactly as ACCEPT or BLOCK. Return NO_MATCH if none matches. ### Constraints - 1 <= rules.length <= 10,000. - 1 <= facts.length <= 10,000. - Total rule text length <= 1,000,000 characters. - Identifiers are ASCII letters, digits, and underscores and begin with a letter. ### Public Examples #### Example 1 Input: rules = ["BLOCK if fraud_flag", "ACCEPT if trusted_partner"], facts = [["fraud_flag", "false"], ["trusted_partner", "true"]] Output: "ACCEPT" The first condition is false and the second is true. #### Example 2 Input: rules = ["ACCEPT if trusted_partner AND amount <= 10000", "BLOCK if amount > 10000"], facts = [["trusted_partner", "true"], ["amount", "12000"]] Output: "BLOCK" The first rule fails its amount comparison; the second rule matches. ### Hints - Separate parsing the ordered rules from evaluating them against one fact table. - Preserve rule order even when two later rules would also match.