proc ::${_pkg}::sid2SDDL sid {
    # Put out the revision and the subauthcount (number of rids)
    binary scan $sid cc rev subauthcount

    if {$rev!=1} {
        ## Log unexpected revision number?
    }

    # Need to treat the 48bit chunk carefully, pull out its hi and lo values
    # so we can handle it correctly
    # We could use SIi* but use the retrieved count to be accurate
    binary scan $sid "x2SIi${subauthcount}" auth_hi auth_lo raw_rids

    # reconstruct the 48 bit chunk
    set 48bit [expr {(wide($auth_hi)<<32)+$auth_lo}]

    # The rids have possibly overflowed
    set final_rids [list]
    foreach rid $raw_rids {
        if {$rid<0} {
            #remove overflow
            set rid [format %u $rid]
        }

        lappend final_rids $rid
    }

    # Construct our SDDL
    # Treat our rids list as a string, replace all spaces with hyphens
    regsub -all { } $final_rids "-" final_rids
    set sddl "S-$rev-$48bit-$final_rids"

    return $sddl
}
