anchor.diff:           }
           ]).
   
  +needs_account_dets() ->
  +    false.
  +
   migration_init() ->
       %% TODO: this fails if the pool is already created. Should be tolerant of
       %% errors and also should tear this down after the migration
       mv_oc_chef_authz_http:create_pool(),
  -    %% TODO: superuser name is somewhat configurable, it's set in oc_erchef's sys.config
  -    {ok, SuperuserResults} = sqerl:adhoc_select([username, id, authz_id], users, {username, equals, <<"pivotal">>}),
  -    Superuser = db_results_to_requestor(hd(SuperuserResults)),
  +    SuperUserAuthzId = envy:get(oc_chef_authz,authz_superuser_id, binary),
  +    Superuser = #mover_requestor{authz_id = SuperUserAuthzId},
   
       FindOrgsWithNoPoliciesContainer = <<"SELECT orgs.name, orgs.id, orgs.authz_id FROM orgs "
                                           "LEFT JOIN containers ON orgs.id = org_id AND containers.name='policies' "
  
positive.code: %%
  %% Code in here is vendored and then modified to remove external dependencies.
  %% This makes the data migration resilent to future code changes that might
  %% break the migration.
  %%
  %% TODO: remove use of these:
  
negative.code: -module(mover_policies_containers_creation_callback).
  
  -export([
       migration_init/0,
       migration_complete/0,
       migration_type/0,
       supervisor/0,
       migration_start_worker_args/2,
       error_halts_migration/0,
       reconfigure_object/2,
       migration_action/2,
       next_object/0,
       needs_account_dets/0
      ]).
  
  -include("mover.hrl").
  -include("mv_oc_chef_authz.hrl").
  
  -record(mover_org, {id, authz_id, name, superuser}).
  -record(mover_requestor, {authz_id}).
  
  %% This is an ACE in human readable form
  -record(mover_hr_ace, {clients = [],
  