I can do a flat text compare, but unfortunately acl outputs are not effective permissions, they're literal. For example: Administrator: Full Control and Administrator: Full Control, Read are effectively identical, but plain text comparisons aren't intelligent enough to work that out.