Be careful when interpreting security descriptors across machine boundaries
While it's true the function can be used to check whether a particular security descriptor grants access to a token, you need to be aware of where that security descriptor came from. If the security descriptor came from another machine (for example, if you got it by calling and passing the path to a file on a network share), calling the function...