anchor.diff:  superuser_id() ->
       envy:get(oc_chef_authz, authz_superuser_id, binary).
   
  +-spec requestor_or_superuser(object_id() | superuser) -> oc_authz_id().
  +requestor_or_superuser(superuser) ->
  +    superuser_id();
  +requestor_or_superuser(ObjectId) ->
  +    ObjectId.
  +
   %% @doc Creates a new Authz entity, if the requestor has the necessary permissions.
   %%
   %% `Creator' either a requestor ID or the atom 'superuser'.  It should only be the superuser
  
positive.code: add_client_to_clients_group(Context, OrgId, ClientAuthzId, RequestorId) ->
      %% We need the superuser ID here because when a validator creates a client, the won't
      %% have the permissions required to add that new client to the clients group.
  
      EffectiveRequestorId = case RequestorId of
                                 superuser ->
                                     envy:get(oc_chef_authz, authz_superuser_id, binary);
                                 RequestorId ->
                                     RequestorId
                             end,
  
      ClientGroupAuthzId = oc_chef_authz_db:fetch_group_authz_id(Context, OrgId, <<"clients">>),
      Url = make_url([<<"groups">>, ClientGroupAuthzId, <<"actors">>, ClientAuthzId]),
      case oc_chef_authz_http:request(Url, put, [], [], EffectiveRequestorId) of
          ok             -> ok;
          {error, Error} -> {error, Error}
      end.
  
  %% @doc As a given actor (`TargetActorId'), remove another actor (`ActorIdToRemove')
  %% completely from its ACL.
  
negative.code: -spec delete_resource(requestor_id(), 'actor'|'group'|'object', object_id())
                       ->  ok | {error, forbidden|not_found|server_error}.
  delete_resource(RequestorId, ResourceType, Id) ->
      EffectiveRequestorId = requestor_or_superuser(RequestorId),
      Url = make_url([pluralize_resource(ResourceType), Id]),
      case oc_chef_authz_http:request(Url, delete, [], [], EffectiveRequestorId) of
          ok -> ok;
          %% Expected errors are forbidden, not_found, server_error
          {error, Error} -> {error, Error}
  