Once upon a time I was in a weird situation where I had to verify/double-check the actions of a puppet-based configuration system to satisfy an unusual requirement. I had a hardening standard which the config management implemented but I had to write all of this shell code to double-check that it did the right thing.