With the new check option on the mysql grants scripts, it is possible that we could have an automated process check the active grants and compare them with what is in the scripts. To do this we would need something running in a place with the grant scripts that could also hit the sql ports of the different databases. On the database end, we would need a user that would need select on mysql.* privs.

Given that the check option and pt-show-grants --noheader --flush output the same information, we should be able to collect and diff the output and warn/alert based on the number of changes.