code: func Covers(ownerRules, servantRules []rbacv1.PolicyRule) (bool, []rbacv1.PolicyRule) {
  	// 1.  Break every servantRule into individual rule tuples: group, verb, resource, resourceName
  	// 2.  Compare the mini-rules against each owner rule.  Because the breakdown is down to the most atomic level, we're guaranteed that each mini-servant rule will be either fully covered or not covered by a single owner rule
  	// 3.  Any left over mini-rules means that we are not covered and we have a nice list of them.
  	// TODO: it might be nice to collapse the list down into something more human readable
  
  	subrules := []rbacv1.PolicyRule{}
  	for _, servantRule := range servantRules {
  		subrules = append(subrules, BreakdownRule(servantRule)...)
  	}
  
  	uncoveredRules := []rbacv1.PolicyRule{}
  	for _, subrule := range subrules {
  		covered := false
  		for _, ownerRule := range ownerRules {
  			if ruleCovers(ownerRule, subrule) {
  				covered = true
  				break
  			}
  		}
  
  		if !covered {
  			uncoveredRules = append(uncoveredRules, subrule)
  		}
  	}
  
  	return (len(uncoveredRules) == 0), uncoveredRules
  }
docs: // Covers determines whether or not the ownerRules cover the servantRules in terms of allowed actions.
  // It returns whether or not the ownerRules cover and a list of the rules that the ownerRules do not cover.