anchor.diff:  %% with the different resource_state records).
   create_in_container(Container, Req, #base_state{chef_authz_context = AuthzContext,
                                                   organization_guid = OrgId,
  -                                                requestor = Requestor,
  +                                                requestor_id = RequestorId,
                                                   resource_state = RS} = State) ->
  -    #chef_requestor{authz_id = RequestorId} = Requestor,
       case chef_authz:create_object_if_authorized(AuthzContext, OrgId, RequestorId,
                                                   Container) of
           {ok, AuthzId} ->
  
positive.code: %% we add a user to the org, and then disassociate them, there will be
  %% acls left behind granting permissions on the org objects, so we
  %% must check user association and permissions
  authorized_by_org_membership_check(Req, #base_state{requester_type=client}=State) ->
      {true, Req, State};
  authorized_by_org_membership_check(Req, State = #base_state{organization_name = OrgName,
                                                              chef_db_context = DbContext}) ->
  
negative.code: %%                      Req :: wm_req(),
  %%                      State :: #base_state{}) -> true | false | Error :: term().
  has_permission(AuthzObjectType, AuthzId, Permission, Req, #base_state{reqid=ReqId,
                                                                        requestor_id=RequestorId}=State) ->
      ?SH_TIME(ReqId, chef_authz, is_authorized_on_resource,
                    (RequestorId, AuthzObjectType, AuthzId, actor, RequestorId, Permission)).
  
  %% NOTE: derives the permission check from the HTTP verb of the Request
  check_permission(AuthzObjectType, AuthzId, Req, #base_state{reqid=ReqId,
                                                              requestor_id=RequestorId
                                                             }=State) ->
      Perm = http_method_to_authz_perm(Req),
      case has_permission(AuthzObjectType, AuthzId, Perm, Req, State) of
  