Defakto On-Prem vs Primary Access Control (2026)