Enforce compliance of SAGs

[AndrewPoppe]

Is your feature request related to a problem? Please describe.

Currently the module only prevents noncompliant rights from being granted and reports on existing noncompliant rights, but it does not prevent users with noncompliant rights from exercising those rights.

Describe the solution you'd like

Two options:

1. The EM restricts access to pages and functions that are not compliant with the SAG definition.
2. The EM removes the rights that are noncompliant.

Option 1 would require significant work and would achieve essentially the same thing as option 2, with the only benefit being that it is not directly altering the user rights.