anchor.diff:  %% `RequestorId' can be the atom `superuser'; in that case, the underlying Authz requests
   %% will be made by the Authz superuser.  If it is a normal ID, that requestor will make the
   %% Authz requests.
  -%%
  -%% Taking this approach instead of a more general "add_to_group" approach since this client
  -%% operation is the only instance.
   -spec add_client_to_clients_group(#oc_chef_authz_context{},
                                    OrgId :: object_id(),
                                    ClientAuthzId :: object_id(),
  
positive.code: 
  -export([
           add_client_to_clients_group/4,
           bulk_actor_is_authorized/5,
           delete_resource/3,
           create_entity_if_authorized/4,
           get_container_aid_for_object/3,
  
negative.code: superuser_id() ->
      envy:get(oc_chef_authz, authz_superuser_id, binary).
  
  -spec requestor_or_superuser(object_id() | superuser) -> oc_authz_id().
  requestor_or_superuser(superuser) ->
      superuser_id();
  requestor_or_superuser(ObjectId) ->
      ObjectId.
  
  %% @doc Creates a new Authz entity, if the requestor has the necessary permissions.
  %%
  %% `Creator' either a requestor ID or the atom 'superuser'.  It should only be the superuser
  