Function fits_within 

pub fn fits_within(old: &[Grant], new: &[Grant]) -> bool

Whether new allows nothing old does not: every allowing grant of new sits at or below an allowing grant of old with at least its kinds. Such an update needs no fresh privileged review.