anchor.diff:                               organization_guid = OrgId,
                                requestor = #chef_requestor{authz_id = ActorId},
                                db_type = DbType} = State,
  -                 RecType, ContainerId, ObjectEjson) ->
  -    %% Note: potential race condition.  If we don't have perms, the create will fail.
  -    %% Although we checked rights above, they could have changed.
  -    {ok, AuthzId} = ?SH_TIME(ReqId, chef_authz,
  -                             create_object_with_container_acl, (ActorId, ContainerId)),
  +                 RecType, AuthzInfo, ObjectEjson) ->
  +    {ok, AuthzId} = maybe_create_authz(ReqId, ActorId, AuthzInfo),
  +
       %% ObjectEjson should already be normalized. Record creation does minimal work and does
       %% not add or update any fields.
       ObjectRec = chef_object:new_record(RecType, OrgId, AuthzId, ObjectEjson,
  
positive.code:     UserName = list_to_binary(wrq:get_req_header("x-ops-userid", Req)),
      BypassesChecks = SuperuserBypassesChecks andalso is_superuser(UserName),
      {UserName, BypassesChecks}.
  
negative.code:     %% a 500 and client can retry. If we succeed and the db call fails or conflicts, we can
      %% safely send a delete to solr since this is a new object with a unique ID unknown to
      %% the world.
      ok = chef_object_db:add_to_solr(TypeName, Id, OrgId,
                                   chef_object:ejson_for_indexing(ObjectRec, ObjectEjson)),
      CreateFun = chef_db:create_fun(ObjectRec),
      case chef_db:CreateFun(DbContext, ObjectRec, ActorId) of
          {conflict, _} ->
              %% ignore return value of solr delete, this is best effort.
              chef_object_db:delete_from_solr(ObjectRec),
  
              LogMsg = {RecType, name_conflict, Name},
              ConflictMsg = conflict_message(TypeName, Name),
  