We did something similar. We create a "snapshot" each Weekend and compare it with the "snapshot" of the last week. Pretty easy via a cronjob. We use the Batch interface of the Metacoda Security Plugin.
The plugin creates a report, that lists every (wished) difference. For example Objects, that got a new ACT, new Users, deleted Users, Capabilities per User that are gone or new,... Looks like this:
#
Test
Reason
1
ACTs/ACT('Server ACT - TS Server')/PermissionPattern/Group('BI Web Services Users')/permissions
Mismatched permission pattern found. Expected <"MCM unspecified"> but got <"+MCM">.
2
ACTs/ACT('Private User Folder ACT')/Objects/complete
The test specifies a COMPLETE set of protected objects for the Access Control Template (ACT) 'Private User Folder ACT'. The test has failed because the ACT was actually found to be applied to an additional 3 unspecified objects. Additional test failures will occur for each unspecified object.
I am pretty sure @PaulHomes or @MichelleHomes can help you.
... View more