I think the natural time to validate this is immediately after loading the 
schema (or some such time in the Roundup startup process), for all 
permissions that have been created at that point, so you always get an 
immediate error for this mistake rather than needing either (a) to run a 
special command to detect such problems or (b) to wait for someone to use 
the particular action etc. that checks a particular permission, which 
might not happen for some time.