diff --git a/vault/util.go b/vault/util.go
index 519c89f38..9548e7363 100644
--- a/vault/util.go
+++ b/vault/util.go
@@ -47,3 +47,14 @@ func strListContains(haystack []string, needle string) bool {
 	}
 	return false
 }
+
+// strListSubset checks if a given list is a subset
+// of another set
+func strListSubset(super, sub []string) bool {
+	for _, item := range sub {
+		if !strListContains(super, item) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/vault/util_test.go b/vault/util_test.go
index 57df236f1..2b1197543 100644
--- a/vault/util_test.go
+++ b/vault/util_test.go
@@ -50,3 +50,34 @@ func TestStrListContains(t *testing.T) {
 		t.Fatalf("Bad")
 	}
 }
+
+func TestStrListSubset(t *testing.T) {
+	parent := []string{
+		"dev",
+		"ops",
+		"prod",
+		"root",
+	}
+	child := []string{
+		"prod",
+		"ops",
+	}
+	if !strListSubset(parent, child) {
+		t.Fatalf("Bad")
+	}
+	if !strListSubset(parent, parent) {
+		t.Fatalf("Bad")
+	}
+	if !strListSubset(child, child) {
+		t.Fatalf("Bad")
+	}
+	if !strListSubset(child, nil) {
+		t.Fatalf("Bad")
+	}
+	if strListSubset(child, parent) {
+		t.Fatalf("Bad")
+	}
+	if strListSubset(nil, child) {
+		t.Fatalf("Bad")
+	}
+}