anchor.diff:      | UNMASK
       | UNSAFE ASSEMBLY
       | UPDATE
  -    | VIEW ANY COLUMN ENCRYPTION KEY DEFINITION
  -    | VIEW ANY COLUMN MASTER KEY DEFINITION
  -    | VIEW ANY DATABASE
  -    | VIEW ANY DEFINITION
  -    | VIEW CHANGE TRACKING
  -    | VIEW DATABASE STATE
  -    | VIEW DEFINITION
  -    | VIEW SERVER STATE
  +    | VIEW ( ANY ( DATABASE | DEFINITION | COLUMN ( ENCRYPTION | MASTER ) KEY DEFINITION )
  +           | CHANGE TRACKING
  +           | DATABASE STATE
  +           | DEFINITION
  +           | SERVER STATE
  +           )
       ;
   
   // https://msdn.microsoft.com/en-us/library/ms190356.aspx
  
positive.code:     | AVAILABILITY GROUP
      | BROKER PRIORITY
      | CERTIFICATE
      | COLUMN ENCRYPTION KEY
      | COLUMN MASTER KEY
      | CONTRACT
      | CREDENTIAL
      | CRYPTOGRAPHIC PROVIDER
      | DATABASE
      | DATABASE AUDIT SPECIFICATION
      | DATABASE ENCRYPTION KEY
      | DATABASE EVENT SESSION
      | DATABASE SCOPED CONFIGURATION
      | DATABASE SCOPED CREDENTIAL
      | DATABASE SCOPED RESOURCE GOVERNOR
      | ENDPOINT
      | EVENT NOTIFICATION DATABASE
      | EVENT NOTIFICATION OBJECT
      | EVENT NOTIFICATION SERVER
      | EVENT SESSION
      | EXTERNAL DATA SOURCE
      | EXTERNAL FILE FORMAT
      | EXTERNAL LIBRARY
      | EXTERNAL RESOURCE POOL
      | EXTERNAL TABLE
      | FULLTEXT CATALOG
      | FULLTEXT STOPLIST
      | LOGIN
      | MASTER KEY
      | MESSAGE TYPE
      | OBJECT
      | PARTITION FUNCTION
      | PARTITION SCHEME
      | REMOTE SERVICE BINDING
      | RESOURCE GOVERNOR
      | ROLE
      | ROUTE
      | SCHEMA
      | SEARCH PROPERTY LIST
      | SERVER
      | SERVER AUDIT
      | SERVER AUDIT SPECIFICATION
      | SERVER ROLE
      | SERVICE
      | SQL LOGIN
      | SYMMETRIC KEY
      | TRIGGER DATABASE
      | TRIGGER SERVER
      | TYPE
      | USER
      | XML SCHEMA COLLECTION
  
negative.code: // FROM sys.fn_builtin_permissions (DEFAULT)
  // ORDER BY 1
  grant_permission
      : ADMINISTER ( BULK OPERATIONS | DATABASE BULK OPERATIONS)
      | ALTER ( ANY ( APPLICATION ROLE
                    | ASSEMBLY
                    | ASYMMETRIC KEY
                    | AVAILABILITY GROUP
                    | CERTIFICATE
                    | COLUMN ( ENCRYPTION KEY | MASTER KEY )
                    | CONNECTION
                    | CONTRACT
                    | CREDENTIAL
                    | DATABASE ( AUDIT
                               | DDL TRIGGER
                               | EVENT ( NOTIFICATION | SESSION )
                               | SCOPED CONFIGURATION
                               )?
                    | DATASPACE
                    | ENDPOINT
                    | EVENT ( NOTIFICATION | SESSION )
                    | EXTERNAL ( DATA SOURCE | FILE FORMAT | LIBRARY)
                    | FULLTEXT CATALOG
                    | LINKED SERVER
                    | LOGIN
                    | MASK
                    | MESSAGE TYPE
                    | REMOTE SERVICE BINDING
                    | ROLE
                    | ROUTE
                    | SCHEMA
                    | SECURITY POLICY
                    | SERVER ( AUDIT | ROLE )
                    | SERVICE
                    | SYMMETRIC KEY
                    | USER
                    )
              | RESOURCES
              | SERVER STATE
              | SETTINGS
              | TRACE
              )?
      | AUTHENTICATE SERVER?
      | BACKUP ( DATABASE | LOG )
      | CHECKPOINT
      | CONNECT ( ANY DATABASE | REPLICATION | SQL )?
      | CONTROL SERVER?
      | CREATE ( AGGREGATE
               | ANY DATABASE
               | ASSEMBLY
               | ASYMMETRIC KEY
               | AVAILABILITY GROUP
               | CERTIFICATE
               | CONTRACT
               | DATABASE (DDL EVENT NOTIFICATION)?
               | DDL EVENT NOTIFICATION
               | DEFAULT
               | ENDPOINT
               | EXTERNAL LIBRARY
               | FULLTEXT CATALOG
               | FUNCTION
               | MESSAGE TYPE
               | PROCEDURE
               | QUEUE
               | REMOTE SERVICE BINDING
               | ROLE
               | ROUTE
               | RULE
               | SCHEMA
               | SEQUENCE
               | SERVER ROLE
               | SERVICE
               | SYMMETRIC KEY
               | SYNONYM
               | TABLE
               | TRACE EVENT NOTIFICATION
               | TYPE
               | VIEW
               | XML SCHEMA COLLECTION
               )
      | DELETE
      | EXECUTE ( ANY EXTERNAL SCRIPT )?
      | EXTERNAL ACCESS ASSEMBLY
      | IMPERSONATE ( ANY LOGIN )?
      | INSERT
      | KILL DATABASE CONNECTION
      | RECEIVE
      | REFERENCES
      | SELECT ( ALL USER SECURABLES )?
      | SEND
      | SHOWPLAN
      | SHUTDOWN
  