Only generate privilege match string once