ACL Remove with optional elements

Acl_Defaults_for_normal.pp

# This is what the defaults look like for normal permissions.
acl { 'c:/temp':
  permissions => [
   { identity => 'Administrator', rights => ['full'] },
   # same as the below
   { identity => 'Administrator', rights=> ['full'], type => 'allow',child_types => 'all', affects => 'all'}
  ]
}

Acl_optional_elements.pp

# This is what I would like the defaults to be when removing listed_permissions. This provides a good set of defaults.
acl { 'c:/temp':
  purge => listed_permissions,
  permissions => [
   { identity => 'Administrator' },
   # same as the below
   { identity => 'Administrator', rights=> ['remove_match_any'], type => 'remove_match_any',child_types => 'remove_match_any', affects => 'remove_match_any'}
  ]
}

Giving rights a default value (where normally it is required to have a value) could be a bit tricky based on purge=> listed_permissions, as purge may not have been set yet (gets set in different orders). This is why validate is a good place to check areas as it is a guarantee that all values have been set in the resource.