diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-0 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-0
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-1 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-1
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-2 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-2
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-3 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-3
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-4 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-4
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-99 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-99
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-0 b/cts/schemas/test-3/ref/acl-drop.ref-0
new file mode 100644
index 0000000000..5c9245aa23
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-0
@@ -0,0 +1,59 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1">
+        <nvpair id="cib-bootstrap-options-remove-after-stop" name="remove-after-stop" value="false" original="1"/>
+      </cluster_property_set>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="rsc1-loc" rsc="rsc1" original="1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-1 b/cts/schemas/test-3/ref/acl-drop.ref-1
new file mode 100644
index 0000000000..1f61c33951
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-1
@@ -0,0 +1,57 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="rsc1-loc" rsc="rsc1" original="1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-2 b/cts/schemas/test-3/ref/acl-drop.ref-2
new file mode 100644
index 0000000000..5d43fa7591
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-2
@@ -0,0 +1,59 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-3 b/cts/schemas/test-3/ref/acl-drop.ref-3
new file mode 100644
index 0000000000..5d43fa7591
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-3
@@ -0,0 +1,59 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-4 b/cts/schemas/test-3/ref/acl-drop.ref-4
new file mode 100644
index 0000000000..cf272a5716
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-4
@@ -0,0 +1,56 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-99 b/cts/schemas/test-3/ref/acl-drop.ref-99
new file mode 100644
index 0000000000..96c9f4fb1c
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-99
@@ -0,0 +1,56 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0">
+  <configuration>
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config>
+      <cluster_property_set id="cib-bootstrap-options"/>
+    </crm_config>
+    <nodes/>
+    <resources>
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
+    </resources>
+    <constraints>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1">
+        <rule id="rsc1-loc-rule-2" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls>
+      <acl_role id="role1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status/>
+</cib>
diff --git a/cts/schemas/test-3/xml/acl-drop.xml b/cts/schemas/test-3/xml/acl-drop.xml
new file mode 100644
index 0000000000..1bf0418ebf
--- /dev/null
+++ b/cts/schemas/test-3/xml/acl-drop.xml
@@ -0,0 +1,59 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="8" num_updates="0" admin_epoch="0">
+  <configuration>
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation, the ACL permissions that refer to the dropped
+         remove-after-stop element, the dropped location constraint, and the
+         meta_attributes block within the nagios resource should have their
+         reference attributes replaced with "xpath='/*[false()]'", which doesn't
+         match anything. The other ACL permissions should remain unchanged.
+      -->
+    <crm_config>
+      <cluster_property_set id="cib-bootstrap-options">
+        <nvpair id="cib-bootstrap-options-remove-after-stop" name="remove-after-stop" value="false"/>
+      </cluster_property_set>
+    </crm_config>
+    <nodes/>
+    <resources>
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
+      <primitive id="rsc2" class="nagios" type="fake">
+        <meta_attributes id="rsc2-meta_attributes"/>
+      </primitive>
+    </resources>
+    <constraints>
+      <rsc_location id="rsc1-loc" rsc="rsc1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
+        </rule>
+        <rule id="rsc1-loc-rule-2" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls>
+      <acl_role id="role1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status/>
+</cib>