for each permission that is checked
    grab a reference to the group (e.g. a `DirectoryEntry` instance)
    if the user isn't in there, add it
    commit
for each permission that is not checked
    grab a reference to the group (e.g. a `DirectoryEntry` instance)
    if the user is in there, remove it
    commit

Grab a fresh list
Compare to the desired results
Display an error if there is any mismatch