anchor.diff:                  false ->    if_has_child_permission(SKey,  ChildRoles, PermissionId)
               end;
           [] ->
  -             %% ToDo: log missing role
  -            false
  +            if_missing_role(RootRoleId)
       end.
   
   if_has_child_permission(_SKey, [], _Permission) -> false;
  
positive.code: if_delete(_SKey, Table, RowId) ->
      imem_meta:delete(Table, RowId).
  
  if_has_role(_SKey, _RootRoleId, _RootRoleId) ->
      true;
  if_has_role(SKey, RootRoleId, RoleId) ->
      case if_read(SKey, ddRole, RootRoleId) of
          [#ddRole{roles=[]}] ->          false;
          [#ddRole{roles=ChildRoles}] ->  if_has_child_role(SKey,  ChildRoles, RoleId);
          [] ->                           %% ToDo: log missing role
                                          false
      end.
  
  if_has_child_role(_SKey, [], _RoleId) -> false;
  
negative.code:                 false ->    if_has_child_permission(SKey,  ChildRoles, PermissionList)
              end;
          [] ->
              if_missing_role(RootRoleId)
      end;
  if_has_permission(SKey, RootRoleId, PermissionId) ->
      %% search for single permission
  