Clojurians Log v2

My design for per-principal authorization currently filters the db with (d/filter db principal-allowed?). I plan to stage writes with (d/with db-auth tx). Before actually transacting I want to find any staged datoms that principal-allowed? would reject, so I can catch writes outside the principal’s authorization. What would be the most idiomatic way to do this? What I’m essentially looking for is an efficient way to check: (= (d/with db tx) (d/filter (d/with db tx) principal-allowed?))