anchor.diff:  invert_perm(Other) ->
       Other.
   
  -
   check_permission(AuthzObjectType, AuthzId, Req, #base_state{reqid=ReqId,
                                                               requestor=RequestorId}=State) ->
       Perm = http_method_to_authz_perm(wrq:method(Req)),
  
positive.code: authorized_by_org_membership_check(Req, #base_state{requester_type=client}=State) ->
      {true, Req, State};
  authorized_by_org_membership_check(Req, State = #base_state{organization_name = OrgName,
                                                             chef_db_context = DbContext}) ->
      UserName = list_to_binary(wrq:get_req_header("x-ops-userid", Req)),
      case chef_db:is_user_in_org(DbContext, UserName, OrgName) of
          true ->
              {true, Req, State};
          false ->
              Msg = forbidden_message(not_member_of_org, UserName, OrgName),
              {false, wrq:set_resp_body(ejson:encode(Msg), Req),
               State#base_state{log_msg = user_not_in_org}};
          Error ->
              Msg = forbidden_message(unverified_org_membership, UserName, OrgName),
              {false, wrq:set_resp_body(ejson:encode(Msg), Req),
               State#base_state{log_msg = {user_not_in_org_error, Error}}}
      end.
  
  forbidden_message(not_member_of_org, User, Org) ->
  
negative.code:                     {true, Req2, State2}
              end;
          {false, ReqOther, StateOther} ->
              %% FIXME: the supported version is determined by the chef_authn application
              %% also, see: https://wiki.corp.opscode.com/display/CORP/RFC+Authentication+Version+Negotiation
              {"X-Ops-Sign version=\"1.0\"", ReqOther, StateOther}
      end.
  
  %%%
  %%% Clients are inherently a member of the org, but users are not.
  