Make the grant stuff explicit

Puppet makes iteration hard, plus it's easier to 
support removal this way.
Spelling is hard
Make the grant check actually work