* warn when incoming vs. outgoing permissions don't match * add a CLI flag to treat warnings as errors
