anchor.diff:                                                              fun chef_sql:select_rows/1)
                             end) of
           not_found ->
  -            throw({not_found, Name});
  +            not_found;
           #oc_chef_group{authz_id = AuthzId} ->
               AuthzId
       end;
   fetch_id(environment, DbContext, Name, OrgId) ->
       case chef_db:fetch(#chef_environment{org_id = OrgId, name = Name}, DbContext) of
           not_found ->
  -            throw({not_found, Name});
  +            not_found;
           #chef_environment{authz_id = AuthzId} ->
               AuthzId
       end.
  
positive.code: 
  validate_authz_id(Req, State, AclState, Type, OrgId, OrgName, DbContext) ->
      Name = chef_wm_util:object_name(Type, Req),
      try
          AuthzId = case Type of
                        cookbook ->
                            fetch_cookbook_id(DbContext, Name, OrgName);
                        NotCookbook ->
                            fetch_id(NotCookbook, DbContext, Name, OrgId)
                    end,
          AclState1 = AclState#acl_state{authz_id = AuthzId},
          % We're doing our own checks, so don't fail on superuser (also, not
          % doing this results in spurious auth failures):
          {Req, State#base_state{resource_state = AclState1,
                                 superuser_bypasses_checks = true}}
      catch
          throw:{not_found, Name} ->
              Message = chef_wm_util:not_found_message(Type, Name),
              Req1 = chef_wm_util:set_json_body(Req, Message),
              {{halt, 404}, Req1, State#base_state{log_msg = acl_not_found}}
      end.
  
  check_acl_auth(Req, #base_state{requestor_id = RequestorId,
                                  resource_state = #acl_state{type = Type,
                                                              authz_id = AuthzId}} = State) ->
      Path = acl_auth_path(Type, AuthzId, RequestorId),
      SuperuserId = envy:get(oc_chef_authz, authz_superuser_id, binary),
      Check = oc_chef_authz_http:request(Path, get, ?DEFAULT_HEADERS, [], SuperuserId),
      case Check of
          ok ->
              {authorized, Req, State};
          {error, not_found} ->
              {{halt, 403}, Req, State};
          Other ->
              Other
      end.
  
  %% Internal functions
  
negative.code:     % fetch does not handle cookbooks (and, well, versioning)
      case chef_db:fetch_latest_cookbook_version(DbContext, OrgName, Name) of
          not_found ->
              not_found;
          {cookbook_exists, AuthzId} ->
              % unclear when this can happen; I assume for wrong version but
              % won't happen with 'latest' version?  But still checking for it
  