anchor.diff:      eligible_subjects :: [aai:subject()],
       operation :: entity_logic:operation(),
       gri :: gri:gri(),
  +    % Service caveats implicitly limit the allowed API - this list contains the list
  +    % of all services that are allowed to perform such operation in case service
  +    % caveat is present.
  +    services_allowed_to_call_this_api :: [aai:service()],
       % Specifies if such operation is available if the auth token contains a data_access_caveat
       available_with_data_access_caveats :: boolean(),
       % Args should typically start with 'auth' atom, which is substituted for client's auth
  
positive.code:         eligible_subjects = [?SUB(user, ClusterAdmin), ?SUB(?ONEPROVIDER, ProviderId)],
          operation = update,
          gri = ?GRI(od_cluster, ClusterId, {user_privileges, ClusterMember}, private),
          available_with_data_access_caveats = false,
          logic_call_args = {cluster_logic, update_user_privileges, [auth, ClusterId, ClusterMember, Data]},
          rest_call_args = {patch, [<<"/clusters/">>, ClusterId, <<"/users/">>, ClusterMember, <<"/privileges">>], Data},
  
negative.code:         eligible_subjects = [?SUB(user, UserId)],
          operation = get,
          gri = ?GRI(od_group, GroupId, instance, protected),
          services_allowed_to_call_this_api = [?OZ_WORKER, ?OP_WORKER],
          available_with_data_access_caveats = false,
          logic_call_args = {group_logic, get_protected_data, [auth, GroupId]},
          rest_call_args = {get, [<<"/groups/">>, GroupId], #{}},
  