anchor.diff:          eligible_subjects = [?SUB(user, UserId)],
           operation = get,
           gri = ?GRI(od_user, UserId, instance, protected),
  +        services_allowed_to_call_this_api = [?OZ_WORKER, ?OZ_PANEL, ?OP_WORKER, ?OP_PANEL],
           available_with_data_access_caveats = true,
           logic_call_args = {user_logic, get_protected_data, [auth, UserId]},
           rest_call_args = {get, [<<"/users/">>, UserId], #{}},
  
positive.code: ]).
  
  
  gen_correct_service_caveat(Rc) ->
      CorrectServices = gen_correct_services(Rc),
      UnverifiedServices = gen_unverified_services(Rc),
      #cv_service{whitelist = lists_utils:shuffle(lists:flatten([
          lists_utils:random_sublist(CorrectServices, 1, all),
          lists_utils:random_sublist(UnverifiedServices)
      ]))}.
  
  gen_unverified_service_caveat(Rc) ->
      case gen_unverified_services(Rc) of
          [] ->
              undefined;
          UnverifiedServices ->
  
negative.code:     eligible_subjects :: [aai:subject()],
      operation :: entity_logic:operation(),
      gri :: gri:gri(),
      % Service caveats implicitly limit the allowed API - this list contains the list
      % of all services that are allowed to perform such operation in case service
      % caveat is present.
      services_allowed_to_call_this_api :: [aai:service()],
      % Specifies if such operation is available if the auth token contains a data_access_caveat
      available_with_data_access_caveats :: boolean(),
      % Args should typically start with 'auth' atom, which is substituted for client's auth
  