anchor.diff:           remove_actor_from_actor_acl/2,
            remove_ace_for_entity/6,
            add_ace_for_entity/6,
  +         set_ace_for_entity/5,
            superuser_id/0
           ]).
   
  
positive.code: %% `RequestorId' can be the atom `superuser'; in that case, the underlying Authz requests
  %% will be made by the Authz superuser.  If it is a normal ID, that requestor will make the
  %% Authz requests.
  %%
  %% Taking this approach instead of a more general "add_to_group" approach since this client
  %% operation is the only instance.
  -spec add_client_to_clients_group(#oc_chef_authz_context{},
                                   OrgId :: object_id(),
                                   ClientAuthzId :: object_id(),
  
negative.code: -spec delete_resource(requestor_id(), 'actor'|'group'|'object', object_id())
                       ->  ok | {error, forbidden|not_found|server_error}.
  delete_resource(RequestorId, ResourceType, Id) ->
      EffectiveRequestorId = requestor_or_superuser(RequestorId),
      Url = make_url([pluralize_resource(ResourceType), Id]),
      case oc_chef_authz_http:request(Url, delete, [], [], EffectiveRequestorId) of
          ok -> ok;
          %% Expected errors are forbidden, not_found, server_error
          {error, Error} -> {error, Error}
  