anchor.diff:  // FROM sys.fn_builtin_permissions (DEFAULT)
   // ORDER BY 1
   grant_permission
  -    : ADMINISTER BULK OPERATIONS
  -    | ADMINISTER DATABASE BULK OPERATIONS
  -    | ALTER
  -    | ALTER ANY APPLICATION ROLE
  -    | ALTER ANY ASSEMBLY
  -    | ALTER ANY ASYMMETRIC KEY
  -    | ALTER ANY AVAILABILITY GROUP
  -    | ALTER ANY CERTIFICATE
  -    | ALTER ANY COLUMN ENCRYPTION KEY
  -    | ALTER ANY COLUMN MASTER KEY
  -    | ALTER ANY CONNECTION
  -    | ALTER ANY CONTRACT
  -    | ALTER ANY CREDENTIAL
  -    | ALTER ANY DATABASE
  -    | ALTER ANY DATABASE AUDIT
  -    | ALTER ANY DATABASE DDL TRIGGER
  -    | ALTER ANY DATABASE EVENT NOTIFICATION
  -    | ALTER ANY DATABASE EVENT SESSION
  -    | ALTER ANY DATABASE SCOPED CONFIGURATION
  -    | ALTER ANY DATASPACE
  -    | ALTER ANY ENDPOINT
  -    | ALTER ANY EVENT NOTIFICATION
  -    | ALTER ANY EVENT SESSION
  -    | ALTER ANY EXTERNAL DATA SOURCE
  -    | ALTER ANY EXTERNAL FILE FORMAT
  -    | ALTER ANY EXTERNAL LIBRARY
  -    | ALTER ANY FULLTEXT CATALOG
  -    | ALTER ANY LINKED SERVER
  -    | ALTER ANY LOGIN
  -    | ALTER ANY MASK
  -    | ALTER ANY MESSAGE TYPE
  -    | ALTER ANY REMOTE SERVICE BINDING
  -    | ALTER ANY ROLE
  -    | ALTER ANY ROUTE
  -    | ALTER ANY SCHEMA
  -    | ALTER ANY SECURITY POLICY
  -    | ALTER ANY SERVER AUDIT
  -    | ALTER ANY SERVER ROLE
  -    | ALTER ANY SERVICE
  -    | ALTER ANY SYMMETRIC KEY
  -    | ALTER ANY USER
  -    | ALTER RESOURCES
  -    | ALTER SERVER STATE
  -    | ALTER SETTINGS
  -    | ALTER TRACE
  -    | AUTHENTICATE
  -    | AUTHENTICATE SERVER
  -    | BACKUP DATABASE
  -    | BACKUP LOG
  +    : ADMINISTER ( BULK OPERATIONS | DATABASE BULK OPERATIONS)
  +    | ALTER ( ANY ( APPLICATION ROLE
  +                  | ASSEMBLY
  +                  | ASYMMETRIC KEY
  +                  | AVAILABILITY GROUP
  +                  | CERTIFICATE
  +                  | COLUMN ( ENCRYPTION KEY | MASTER KEY )
  +                  | CONNECTION
  +                  | CONTRACT
  +                  | CREDENTIAL
  +                  | DATABASE ( AUDIT
  +                             | DDL TRIGGER
  +                             | EVENT ( NOTIFICATION | SESSION )
  +                             | SCOPED CONFIGURATION
  +                             )?
  +                  | DATASPACE
  +                  | ENDPOINT
  +                  | EVENT ( NOTIFICATION | SESSION )
  +                  | EXTERNAL ( DATA SOURCE | FILE FORMAT | LIBRARY)
  +                  | FULLTEXT CATALOG
  +                  | LINKED SERVER
  +                  | LOGIN
  +                  | MASK
  +                  | MESSAGE TYPE
  +                  | REMOTE SERVICE BINDING
  +                  | ROLE
  +                  | ROUTE
  +                  | SCHEMA
  +                  | SECURITY POLICY
  +                  | SERVER ( AUDIT | ROLE )
  +                  | SERVICE
  +                  | SYMMETRIC KEY
  +                  | USER
  +                  )
  +            | RESOURCES
  +            | SERVER STATE
  +            | SETTINGS
  +            | TRACE
  +            )?
  +    | AUTHENTICATE SERVER?
  +    | BACKUP ( DATABASE | LOG )
       | CHECKPOINT
  -    | CONNECT
  -    | CONNECT ANY DATABASE
  -    | CONNECT REPLICATION
  -    | CONNECT SQL
  -    | CONTROL
  -    | CONTROL SERVER
  -    | CREATE AGGREGATE
  -    | CREATE ANY DATABASE
  -    | CREATE ASSEMBLY
  -    | CREATE ASYMMETRIC KEY
  -    | CREATE AVAILABILITY GROUP
  -    | CREATE CERTIFICATE
  -    | CREATE CONTRACT
  -    | CREATE DATABASE
  -    | CREATE DATABASE DDL EVENT NOTIFICATION
  -    | CREATE DDL EVENT NOTIFICATION
  -    | CREATE DEFAULT
  -    | CREATE ENDPOINT
  -    | CREATE EXTERNAL LIBRARY
  -    | CREATE FULLTEXT CATALOG
  -    | CREATE FUNCTION
  -    | CREATE MESSAGE TYPE
  -    | CREATE PROCEDURE
  -    | CREATE QUEUE
  -    | CREATE REMOTE SERVICE BINDING
  -    | CREATE ROLE
  -    | CREATE ROUTE
  -    | CREATE RULE
  -    | CREATE SCHEMA
  -    | CREATE SEQUENCE
  -    | CREATE SERVER ROLE
  -    | CREATE SERVICE
  -    | CREATE SYMMETRIC KEY
  -    | CREATE SYNONYM
  -    | CREATE TABLE
  -    | CREATE TRACE EVENT NOTIFICATION
  -    | CREATE TYPE
  -    | CREATE VIEW
  -    | CREATE XML SCHEMA COLLECTION
  +    | CONNECT ( ANY DATABASE | REPLICATION | SQL )?
  +    | CONTROL SERVER?
  +    | CREATE ( AGGREGATE
  +             | ANY DATABASE
  +             | ASSEMBLY
  +             | ASYMMETRIC KEY
  +             | AVAILABILITY GROUP
  +             | CERTIFICATE
  +             | CONTRACT
  +             | DATABASE (DDL EVENT NOTIFICATION)?
  +             | DDL EVENT NOTIFICATION
  +             | DEFAULT
  +             | ENDPOINT
  +             | EXTERNAL LIBRARY
  +             | FULLTEXT CATALOG
  +             | FUNCTION
  +             | MESSAGE TYPE
  +             | PROCEDURE
  +             | QUEUE
  +             | REMOTE SERVICE BINDING
  +             | ROLE
  +             | ROUTE
  +             | RULE
  +             | SCHEMA
  +             | SEQUENCE
  +             | SERVER ROLE
  +             | SERVICE
  +             | SYMMETRIC KEY
  +             | SYNONYM
  +             | TABLE
  +             | TRACE EVENT NOTIFICATION
  +             | TYPE
  +             | VIEW
  +             | XML SCHEMA COLLECTION
  +             )
       | DELETE
  -    | EXECUTE
  -    | EXECUTE ANY EXTERNAL SCRIPT
  +    | EXECUTE ( ANY EXTERNAL SCRIPT )?
       | EXTERNAL ACCESS ASSEMBLY
  -    | IMPERSONATE
  -    | IMPERSONATE ANY LOGIN
  +    | IMPERSONATE ( ANY LOGIN )?
       | INSERT
       | KILL DATABASE CONNECTION
       | RECEIVE
       | REFERENCES
  -    | SELECT
  -    | SELECT ALL USER SECURABLES
  +    | SELECT ( ALL USER SECURABLES )?
       | SEND
       | SHOWPLAN
       | SHUTDOWN
  
positive.code:     | UNMASK
      | UNSAFE ASSEMBLY
      | UPDATE
      | VIEW ANY COLUMN ENCRYPTION KEY DEFINITION
      | VIEW ANY COLUMN MASTER KEY DEFINITION
      | VIEW ANY DATABASE
      | VIEW ANY DEFINITION
      | VIEW CHANGE TRACKING
      | VIEW DATABASE STATE
      | VIEW DEFINITION
      | VIEW SERVER STATE
      ;
  
  // https://msdn.microsoft.com/en-us/library/ms190356.aspx
  
negative.code:     | AVAILABILITY GROUP
      | BROKER PRIORITY
      | CERTIFICATE
      | COLUMN ( ENCRYPTION | MASTER ) KEY
      | CONTRACT
      | CREDENTIAL
      | CRYPTOGRAPHIC PROVIDER
      | DATABASE ( AUDIT SPECIFICATION
                 | ENCRYPTION KEY
                 | EVENT SESSION
                 | SCOPED ( CONFIGURATION
                          | CREDENTIAL
                          | RESOURCE GOVERNOR )
                 )?
      | ENDPOINT
      | EVENT SESSION | ( NOTIFICATION (DATABASE | OBJECT | SERVER ) )
      | EXTERNAL ( DATA SOURCE
                 | FILE FORMAT
                 | LIBRARY
                 | RESOURCE POOL
                 | TABLE
                 | CATALOG
                 | STOPLIST
                 )
      | LOGIN
      | MASTER KEY
      | MESSAGE TYPE
      | OBJECT
      | PARTITION ( FUNCTION | SCHEME)
      | REMOTE SERVICE BINDING
      | RESOURCE GOVERNOR
      | ROLE
      | ROUTE
      | SCHEMA
      | SEARCH PROPERTY LIST
      | SERVER ( ( AUDIT SPECIFICATION? ) | ROLE )?
      | SERVICE
      | SQL LOGIN
      | SYMMETRIC KEY
      | TRIGGER ( DATABASE | SERVER)
      | TYPE
      | USER
      | XML SCHEMA COLLECTION
  