Process gids only when needed
Make restrictions word readable
Cache fallback restrictions