diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-0 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-0
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-1 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-1
new file mode 100644
index 0000000000..a2e1bf669f
--- /dev/null
+++ b/cts/schemas/test-3/ref.err/acl-drop.ref.err-1
@@ -0,0 +1 @@
+WARNING: Dropping nvpair cib-bootstrap-options-remove-after-stop because the remove-after-stop property is unsupported
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-2 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-2
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-3 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-3
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-4 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-4
new file mode 100644
index 0000000000..801a486a2b
--- /dev/null
+++ b/cts/schemas/test-3/ref.err/acl-drop.ref.err-4
@@ -0,0 +1 @@
+WARNING: Dropping resource rsc2 because nagios resources are no longer supported
diff --git a/cts/schemas/test-3/ref.err/acl-drop.ref.err-99 b/cts/schemas/test-3/ref.err/acl-drop.ref.err-99
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-0 b/cts/schemas/test-3/ref/acl-drop.ref-0
new file mode 100644
index 0000000000..e86863bba6
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-0
@@ -0,0 +1,63 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1">
+        <nvpair id="cib-bootstrap-options-remove-after-stop" name="remove-after-stop" value="false" original="1"/>
+      </cluster_property_set>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="rsc1-loc" rsc="rsc1" original="1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-1 b/cts/schemas/test-3/ref/acl-drop.ref-1
new file mode 100644
index 0000000000..26431a2011
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-1
@@ -0,0 +1,61 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="rsc1-loc" rsc="rsc1" original="1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-2 b/cts/schemas/test-3/ref/acl-drop.ref-2
new file mode 100644
index 0000000000..d76cc57df6
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-2
@@ -0,0 +1,63 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="//*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-3 b/cts/schemas/test-3/ref/acl-drop.ref-3
new file mode 100644
index 0000000000..d76cc57df6
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-3
@@ -0,0 +1,63 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+      <primitive id="rsc2" class="nagios" type="fake" original="1">
+        <meta_attributes id="rsc2-meta_attributes" original="1"/>
+      </primitive>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="//*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-4 b/cts/schemas/test-3/ref/acl-drop.ref-4
new file mode 100644
index 0000000000..d6993cbafe
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-4
@@ -0,0 +1,60 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
+  <configuration original="1">
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config original="1">
+      <cluster_property_set id="cib-bootstrap-options" original="1"/>
+    </crm_config>
+    <nodes original="1"/>
+    <resources original="1">
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy" original="1"/>
+    </resources>
+    <constraints original="1">
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-1" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1" original="0">
+        <rule id="rsc1-loc-rule-2" score="INFINITY" original="1">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01" original="1"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls original="1">
+      <acl_role id="role1" original="1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop" original="1"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="//*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']" original="1"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes" original="1"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1" original="1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop" original="1"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status original="1"/>
+</cib>
diff --git a/cts/schemas/test-3/ref/acl-drop.ref-99 b/cts/schemas/test-3/ref/acl-drop.ref-99
new file mode 100644
index 0000000000..043c93eb81
--- /dev/null
+++ b/cts/schemas/test-3/ref/acl-drop.ref-99
@@ -0,0 +1,60 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0">
+  <configuration>
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config>
+      <cluster_property_set id="cib-bootstrap-options"/>
+    </crm_config>
+    <nodes/>
+    <resources>
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
+    </resources>
+    <constraints>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-1" rsc="rsc1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
+        </rule>
+      </rsc_location>
+      <rsc_location id="pcmk__3_10_upgrade-rsc1-loc-2" rsc="rsc1">
+        <rule id="rsc1-loc-rule-2" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls>
+      <acl_role id="role1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" xpath="/*[false()]"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" xpath="//*[@id = 'pcmk__3_10_upgrade-rsc1-loc-1' or @id = 'pcmk__3_10_upgrade-rsc1-loc-2']"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" xpath="/*[false()]"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status/>
+</cib>
diff --git a/cts/schemas/test-3/xml/acl-drop.xml b/cts/schemas/test-3/xml/acl-drop.xml
new file mode 100644
index 0000000000..34817bb236
--- /dev/null
+++ b/cts/schemas/test-3/xml/acl-drop.xml
@@ -0,0 +1,63 @@
+<cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="8" num_updates="0" admin_epoch="0">
+  <configuration>
+    <!-- The essential elements of this test are:
+         * There is a remove-after-stop property that will be dropped.
+         * There is a location constraint that will be replaced by two new
+           location constraints, such that the original constraint ID no longer
+           exists.
+         * There is a nagios resource that will be dropped, and it contains a
+           meta_attributes block.
+         * There is an OCF resource that will be kept.
+         * There are ACL permissions that refer directly to the
+           remove-after-stop element and original location constraint mentioned
+           listed above.
+         * There is an ACL permissions that refers directly to the
+           meta_attributes block nested within the nagios resource.
+         * There is an ACL permission that refers directly to the OCF resource.
+         * There is an ACL permission that refers directly to the ACL permission
+           for the remove-after-stop property.
+
+         In this situation:
+         * The ACL permissions that refer to the dropped remove-after-stop
+           element and the meta_attributes block within the dropped nagios
+           resource should have their reference attributes replaced with
+           "xpath='/*[false()]'", which doesn't match anything.
+         * The ACL permission that refers to the location constraint should have
+           its reference attribute replaced with an xpath attribute that matches
+           the IDs of the replacement constraints.
+         * The other ACL permissions should remain unchanged.
+      -->
+    <crm_config>
+      <cluster_property_set id="cib-bootstrap-options">
+        <nvpair id="cib-bootstrap-options-remove-after-stop" name="remove-after-stop" value="false"/>
+      </cluster_property_set>
+    </crm_config>
+    <nodes/>
+    <resources>
+      <primitive id="rsc1" class="ocf" provider="pacemaker" type="Dummy"/>
+      <primitive id="rsc2" class="nagios" type="fake">
+        <meta_attributes id="rsc2-meta_attributes"/>
+      </primitive>
+    </resources>
+    <constraints>
+      <rsc_location id="rsc1-loc" rsc="rsc1">
+        <rule id="rsc1-loc-rule-1" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-1-expr" operation="gt" start="2021-01-01"/>
+        </rule>
+        <rule id="rsc1-loc-rule-2" score="INFINITY">
+          <date_expression id="rsc1-loc-rule-2-expr" operation="gt" start="2022-01-01"/>
+        </rule>
+      </rsc_location>
+    </constraints>
+    <acls>
+      <acl_role id="role1">
+        <acl_permission id="role1-deny-property-drop" kind="deny" reference="cib-bootstrap-options-remove-after-stop"/>
+        <acl_permission id="role1-deny-rsc1-loc-drop" kind="deny" reference="rsc1-loc"/>
+        <acl_permission id="role1-deny-rsc2-meta_attributes-drop" kind="deny" reference="rsc2-meta_attributes"/>
+        <acl_permission id="role1-deny-rsc1-keep" kind="deny" reference="rsc1"/>
+        <acl_permission id="role1-deny-role1-deny-property-drop-keep" kind="deny" reference="role1-deny-property-drop"/>
+      </acl_role>
+    </acls>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/upgrade-3.10-2.xsl b/xml/upgrade-3.10-2.xsl
index 4cfce8412f..fe8203ad60 100644
--- a/xml/upgrade-3.10-2.xsl
+++ b/xml/upgrade-3.10-2.xsl
@@ -1,270 +1,322 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
  Use comments liberally as future maintainers may be unfamiliar with XSLT.
  -->
 
 <!--
  upgrade-3.10-2.xsl
 
  Guarantees after this transformation:
  * Within a given nvset, there is at most one nvpair with a given name. If there
    were duplicates prior to this transformation, only the first one is kept.
  * There are no ping nodes. If a node was a ping node prior to this
    transformation, it is now a member (cluster) node with all resources banned
    and probes disabled.
  * There are no legacy promotable clone resources. If a resource was a legacy
    promotable clone prior to this transformation, it is now a standard
    promotable clone (that is, a clone with the meta-attribute "promotable" set
    to "true").
  * There is at most one top-level rule within a location constraint. If a
    location constraint had N top-level rules (N > 1) prior to this
    transformation, it is now converted to N location constraints, each with a
    single top-level rule.
 
  Anything that matches all resource types should be placed in a later
  transformation, so that it can ignore the possibility of legacy promotable
  clone resources.
  -->
 
 <xsl:stylesheet version="1.0"
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
 <xsl:import href="upgrade-3.10-common.xsl"/>
 
+<!-- Index all location constraints by ID -->
+<xsl:key name="location_id" match="//rsc_location" use="@id"/>
+
 <!--
  Copy everything unaltered by default, except optionally set "original"
 
  Params:
  * original: See identity template
  -->
 <xsl:template match="/|@*|node()">
     <xsl:param name="original"/>
 
     <xsl:call-template name="identity">
         <xsl:with-param name="original" select="$original"/>
     </xsl:call-template>
 </xsl:template>
 
 
 <!-- Name/value pairs -->
 
 <!--
  Ensure there is at most one nvpair with a given name in a given nvset.
 
  By dropping the ignored duplicates now, we facilitate later transformations in
  which we drop nvpairs with certain values. The later steps will involve
  comparisons among multiple nvsets. These are easier to reason about and to
  regression-test if, prior to that, we drop all but one nvpair with a given name
  in a given nvset.
  -->
 
 <!--
  Drop nvpairs with value="#default" if there is a later nvpair with the same
  name. Value "#default" unsets the option, so any later nvpair takes precedence.
 -->
 <xsl:template match="nvpair[(@value = '#default')
                             and (@name = following-sibling::*/@name)]"/>
 
 <!--
  Drop nvpairs with a value other than "#default" if certain conditions (detailed
  below) are satisfied.
  -->
 <xsl:template match="nvpair[@value != '#default']">
     <!-- All preceding sibling nvpairs with the same name -->
     <xsl:variable name="before"
                   select="preceding-sibling::nvpair[@name = current()/@name]"/>
 
     <!-- All following sibling nvpairs with the same name -->
     <xsl:variable name="after"
                   select="following-sibling::nvpair[@name = current()/@name]"/>
 
     <!--
      Last preceding sibling nvpair with the same name and value "#default"
      -->
     <xsl:variable name="last_default_before"
                   select="$before[@value = '#default'][last()]"/>
 
     <xsl:choose>
         <!--
          Drop if there's a following sibling with the same name and value
          "#default". The later "#default" value would unset the current nvpair's
          value.
          -->
         <xsl:when test="$after[@value = '#default']"/>
 
         <!--
          Drop if both:
          * There's a preceding sibling nvpair with the same name
          * Either of the following:
            * There's no preceding sibling nvpair with the same name and value
              "#default"
            * There's a preceding sibling nvpair with the same name between the
              most recent "#default" and the current node.
 
          The preceding sibling nvpair would take effect, and there is no
          "#default" value to unset it before we reach the current nvpair.
 
          This uses an XPath 1.0 set intersection idiom.
          -->
         <xsl:when test="$before
                         and (not($last_default_before)
                              or $last_default_before/following-sibling::nvpair
                                 [count(.|$before) = count($before)])"/>
 
         <!-- Otherwise, keep the nvpair -->
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 
 <!-- Nodes -->
 
 <!--
  Transform ping nodes to cluster (member) nodes. The constraints template bans
  all resources from the newly transformed nodes.
 -->
 <xsl:template match="node[@type = 'ping']">
     <xsl:copy>
         <xsl:apply-templates select="@*"/>
         <xsl:attribute name="type">member</xsl:attribute>
         <xsl:apply-templates select="node()"/>
     </xsl:copy>
 </xsl:template>
 
 
 <!-- Resources -->
 
 <!--
  Convert master resources to clones with promotable meta-attribute set to "true"
  -->
 <xsl:template match="master">
     <xsl:element name="clone">
         <xsl:apply-templates select="@*"/>
 
         <!--
          Prepend new meta_attributes element that takes precedence over all
          others, with promotable="true"
         -->
         <xsl:element name="meta_attributes">
             <xsl:variable name="meta_id"
                           select="concat($upgrade_prefix, 'promotable-legacy-',
                                          @id, '-meta_attributes')"/>
 
             <xsl:attribute name="id">
                 <xsl:value-of select="$meta_id"/>
             </xsl:attribute>
 
             <!-- Override any manually configured meta-attributes -->
             <xsl:attribute name="score">INFINITY</xsl:attribute>
 
             <xsl:element name="nvpair">
                 <xsl:attribute name="id">
                     <xsl:value-of select="concat($meta_id, '-promotable')"/>
                 </xsl:attribute>
                 <xsl:attribute name="name">promotable</xsl:attribute>
                 <xsl:attribute name="value">true</xsl:attribute>
             </xsl:element>
         </xsl:element>
 
         <!-- Keep all existing children -->
         <xsl:apply-templates select="node()"/>
     </xsl:element>
 </xsl:template>
 
 <!--
  Rename a bundle container's masters attribute to promoted-max. (This is the
  only place the schema allows a masters attribute.)
  -->
 <xsl:template match="@masters">
     <xsl:attribute name="promoted-max">
         <xsl:value-of select="."/>
     </xsl:attribute>
 </xsl:template>
 
 
 <!-- Constraints -->
 
 <xsl:template match="constraints">
     <xsl:copy>
         <!-- Existing contents -->
         <xsl:apply-templates select="@*|node()"/>
 
         <!--
          Ban all resources from each ping node (converted to a cluster node via
          another template)
          -->
         <xsl:for-each select="//node[@type = 'ping']">
             <xsl:element name="rsc_location">
                 <xsl:attribute name="id">
                     <xsl:value-of select="concat($upgrade_prefix,
                                                  'ping-node-ban-', @uname)"/>
                 </xsl:attribute>
                 <xsl:attribute name="rsc-pattern">.*</xsl:attribute>
                 <xsl:attribute name="node">
                     <xsl:value-of select="@uname"/>
                 </xsl:attribute>
                 <xsl:attribute name="score">-INFINITY</xsl:attribute>
                 <xsl:attribute name="resource-discovery">never</xsl:attribute>
             </xsl:element>
         </xsl:for-each>
     </xsl:copy>
 </xsl:template>
 
 <!--
  If a location constraint contains multiple top-level rules, replace it with
  a set of new location constraints, one for each top-level rule.
  -->
 <xsl:template match="rsc_location[count(rule) > 1]">
     <xsl:for-each select="rule">
         <xsl:element name="rsc_location">
             <!-- Copy attributes from the original rsc_location -->
             <xsl:apply-templates select="../@*"/>
             <xsl:attribute name="original">0</xsl:attribute>
 
             <!--
              Set a probably-unique ID for the new rsc_location, based on the
              existing rsc_location's ID and the rule's position
              -->
             <xsl:attribute name="id">
                 <xsl:value-of select="concat($upgrade_prefix, ../@id, '-',
                                              position())"/>
             </xsl:attribute>
 
             <!-- Add resource sets, rule, and lifetime (in order) -->
             <xsl:choose>
                 <!--
                  The descendants of the first rsc_location created should keep
                  their "original" values from the old rsc_location, if any
                  -->
                 <xsl:when test="position() = 1">
                     <xsl:apply-templates select="../resource_set"/>
                     <xsl:apply-templates select="."/>
                     <xsl:apply-templates select="../lifetime"/>
                 </xsl:when>
 
                 <!--
                  The descendants of later rsc_location elements should all have
                  original="0" for resource_set and lifetime elements. The rule
                  element should keep its existing "original" value, since it
                  will occur in exactly one of the newly created constraints.
                  -->
                 <xsl:otherwise>
                     <xsl:apply-templates select="../resource_set">
                         <xsl:with-param name="original" select="'0'"/>
                     </xsl:apply-templates>
                     <xsl:apply-templates select=".">
                         <xsl:with-param name="original"/>
                     </xsl:apply-templates>
                     <xsl:apply-templates select="../lifetime">
                         <xsl:with-param name="original" select="'0'"/>
                     </xsl:apply-templates>
                 </xsl:otherwise>
             </xsl:choose>
         </xsl:element>
     </xsl:for-each>
 </xsl:template>
 
+
+<!-- ACLs -->
+
+<!--
+ If an ACL permission refers to a location constraint with multiple top-level
+ rules, replace the reference attribute with an xpath attribute. The xpath
+ attribute should match the IDs of all the new location constraints that replace
+ the original one.
+
+ Mirror the logic from the "rsc_location[count(rule) > 1]" template.
+-->
+<xsl:template match="acl_permission/@reference">
+    <xsl:variable name="location" select="key('location_id', .)"/>
+
+    <xsl:choose>
+        <xsl:when test="$location and $location[count(rule) > 1]">
+            <!--
+             This ACL refers to a constraint that is replaced by multiple new
+             ones. Update accordingly.
+             -->
+
+            <!-- Use variable as a hack to avoid parsing difficulties -->
+            <xsl:variable name="apos">'</xsl:variable>
+
+            <xsl:attribute name="xpath">
+                <xsl:value-of select="'//*['"/>
+
+                <xsl:for-each select="$location/rule">
+                    <xsl:variable name="cons_id"
+                                  select="concat($upgrade_prefix, ../@id, '-',
+                                                 position())"/>
+
+                    <xsl:if test="position() > 1">
+                        <xsl:value-of select="' or '"/>
+                    </xsl:if>
+                    <xsl:value-of select="concat('@id = ', $apos, $cons_id,
+                                                 $apos)"/>
+                </xsl:for-each>
+
+                <xsl:value-of select="']'"/>
+            </xsl:attribute>
+        </xsl:when>
+
+        <xsl:otherwise>
+            <xsl:call-template name="identity"/>
+        </xsl:otherwise>
+    </xsl:choose>
+</xsl:template>
+
 </xsl:stylesheet>
diff --git a/xml/upgrade-3.10-99.xsl b/xml/upgrade-3.10-99.xsl
index bad2ef5da8..da58a83f9d 100644
--- a/xml/upgrade-3.10-99.xsl
+++ b/xml/upgrade-3.10-99.xsl
@@ -1,71 +1,96 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
  Use comments liberally as future maintainers may be unfamiliar with XSLT.
  -->
 
 <!--
  upgrade-3.10-99.xsl
 
  Guarantees after this transformation:
  * All attributes of type ID are unique (assuming that was the case for the
    original input XML). Any elements with id-refs that were resolved in the
    first step of the transformation pipeline have been converted back to
    id-refs. See upgrade-3.10-common.xsl for details.
+ * If an acl_permission has a reference attribute, it's a valid IDREF. This was
+   the case before the transformation pipeline began, but element removals in
+   earlier stages may have invalidated some ACL permissions.
 
  This file is numbered 99 because it must be the last stylesheet in the
  pipeline. This numbering allows us to add more stylesheets without needing to
  continually rename this one. When all transformation development work is
  finished, we can re-number it.
  -->
 
 <xsl:stylesheet version="1.0"
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
 <xsl:import href="upgrade-3.10-common.xsl"/>
 
+<!-- Index all elements by ID -->
+<xsl:key name="element_id" match="*" use="@id"/>
+
 <!-- Copy everything unaltered by default -->
 <xsl:template match="/|@*|node()">
     <xsl:call-template name="identity"/>
 </xsl:template>
 
 <!--
  If an element was converted from id-ref to the referenced element earlier in
  the upgrade transformation pipeline, convert it back to an id-ref as described
  in upgrade-3.10-common.xsl
  -->
 <xsl:template match="*[@id]">
     <!--
      Convert to an id-ref if @original is 0 or unset and
      * there is any element with the same id value and original="1", or
      * there is any preceding element with the same id value
 
      The preceding axis doesn't include ancestors. While it would likely be
      nonsense to reference an ancestor, it is allowed by the schema.
 
      The idea for the second point is that if all elements with a given id value
      have original set to "0" or unset, the first one should remain a definition
      while the rest become references.
      -->
     <xsl:choose>
         <xsl:when test="not(number(@original))
                         and (//*[(@id = current()/@id) and number(@original)]
                              or preceding::*[@id = current()/@id]
                              or ancestor::*[@id = current()/@id])">
             <xsl:copy>
                 <xsl:attribute name="id-ref">
                     <xsl:value-of select="@id"/>
                 </xsl:attribute>
             </xsl:copy>
         </xsl:when>
 
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 <!-- Drop "original" attribute -->
 <xsl:template match="@original"/>
 
+
+<!-- ACLs -->
+
+<!--
+ "Drop" ACL permissions that refer to a nonexistent element ID.
+
+ Rather than truly dropping the permission, we replace its reference attribute
+ with an xpath attribute whose value ("/*[false()]") doesn't match anything.
+ This avoids dependency chains in which one ACL permission refers to the ID of
+ another ACL permission that is also removed at this stage.
+ -->
+<xsl:template match="acl_permission
+                     [@reference and not(key('element_id', @reference))]
+                     /@reference">
+    <xsl:attribute name="xpath">
+        <xsl:value-of select="'/*[false()]'"/>
+    </xsl:attribute>
+</xsl:template>
+
 </xsl:stylesheet>