Hello @MarkNicholas,
that is quite a hard/tricky job, I would advise you to talk to SAS Technical Support about it.
There is a great tool, to check metadata permissions and roles, Metacoda. ( @MichelleHomes, @PaulHomes, I summon you). You can peek the took at www.metacoda.com and if you are interested on it, I am sure Michelle and Paul Homes can give you more details.
In short, this tool can create a report of your SAS metadata permissions, groups, and roles memberships. SAS Portal has, additionally to the SAS metadata, an additional set up, not query-able by Metacoda. Perhaps you won't need that additional stuff for your purposes, then the Metacoda tool is enough. if you need the additional info, best way is to contact SAS Tech Support.