anchor.diff:      %% single user
       add_source([User], CIDR, Source, Options).
   
  +
  +%% ============
  +%% INTERNAL
  +%% ============
  +
  +add_revoke_int([], _, _) ->
  +    ok;
  +add_revoke_int([User|Users], Bucket, Permissions) ->
  +    UserGrants = riak_core_metadata:get({<<"security">>, <<"grants">>}, {User,
  +                                                                         Bucket}),
  +
  +    %% check if there is currently a GRANT we can revoke
  +    case UserGrants of
  +        undefined ->
  +            %% can't REVOKE what wasn't GRANTED
  +            add_revoke_int(Users, Bucket, Permissions);
  +        GrantedPermissions ->
  +            NewPerms = [X || X <- GrantedPermissions, not lists:member(X,
  +                                                                       Permissions)],
  +
  +            %% TODO - do deletes here, once cluster metadata supports it for
  +            %% real, if NeePerms == []
  +
  +            riak_core_metadata:put({<<"security">>, <<"grants">>}, {User,
  +                                                                  Bucket},
  +                                   NewPerms),
  +            add_revoke_int(Users, Bucket, Permissions)
  +    end.
  +
   add_source_int([], _, _, _) ->
       ok;
   add_source_int([User|Users], CIDR, Source, Options) ->
  
positive.code:         false ->
              %% no applicable grant
              {false, io_lib:format("Permission denied: User '~s' does not have"
                                    "'~s' on ~p", [Username,
                                                   Permission,
                                                   Bucket]), Context}
      end.
  
negative.code:         false ->
              %% no applicable grant
              {false, io_lib:format("Permission denied: User '~s' does not have"
                                    "'~s' on ANY", [Context#context.username,
                                                   Permission]), Context}
      end;
  check_permission({Permission, Bucket}, Context0) ->
      Context = maybe_refresh_context(Context0),
      MatchG = match_grant(Bucket, Context#context.grants),
      case MatchG /= undefined andalso
           (lists:member(Permission, MatchG) orelse MatchG == 'all') of
          true ->
  