SENTRY-370 MSentryPrivilege implies child privileges