anchor.diff:      PublicKey;
   public_key(#chef_client{public_key = PublicKey}) ->
       PublicKey.
  +
  +%%
  +%% forbidden helpers
  +%%
  +handle_authz_check(chef_wm_cookbook_version, Req, #base_state{requestor = Requestor}) ->
  +    case wrq:method(Req) of
  +        'PUT' -> %% create && update
  +            is_admin(Requestor);
  +        'DELETE' ->
  +            is_admin(Requestor);
  +        _Else ->
  +            true
  +    end;
  +handle_authz_check(chef_wm_data, Req, #base_state{requestor = Requestor}) ->
  +    case wrq:method(Req) of
  +        'POST' -> %% create data
  +            is_admin(Requestor);
  +        _Else ->
  +            true
  +    end;
  +handle_authz_check(chef_wm_named_data, Req, #base_state{requestor = Requestor}) ->
  +    case wrq:method(Req) of
  +        'POST' -> %% create data_item
  +            is_admin(Requestor);
  +        'DELETE' -> %% delete data
  +            is_admin(Requestor);
  +        _Else ->
  +            true
  +    end;
  +handle_authz_check(chef_wm_named_data_item, Req, #base_state{requestor = Requestor}) ->
  +    case wrq:method(Req) of
  +        'PUT' -> %% update data_item
  +            is_admin(Requestor);
  +        'DELETE' -> %% delete data_item
  +            is_admin(Requestor);
  +        _Else ->
  +            true
  +    end;
  +handle_authz_check(chef_wm_roles, Req, #base_state{requestor = Requestor}) ->
  +    case wrq:method(Req) of
  +        'POST' ->
  +            is_admin(Requestor);
  +        _Else ->
  +            true
  +    end;
  +handle_authz_check(chef_wm_named_role, Req, #base_state{requestor = Requestor}) ->
  +    case wrq:method(Req) of
  +        'PUT' ->
  +            is_admin(Requestor);
  +        'DELETE' ->
  +            is_admin(Requestor);
  +        _Else ->
  +            true
  +    end;
  +%% Default case is to allow all requests
  +handle_authz_check(_Mod, _Req, _State) ->
  +    true.
  +
  +%%
  +%% TODO implement is_FOO functions for #chef_user{} when the record
  +%% has an 'admin' field
  +%%
  +
  +-spec is_admin(#chef_client{}) -> boolean().
  +is_admin(#chef_client{admin = true}) ->
  +    true;
  +is_admin(#chef_client{}) ->
  +    false.
  +
  +
  +-spec is_admin_or_validator(#chef_client{}) -> boolean().
  +is_admin_or_validator(#chef_client{validator = true} = Client) ->
  +    is_admin(Client);
  +is_admin_or_validator(#chef_client{}) ->
  +    false.
  +
  +is_admin_or_requesting_node(#chef_client{name = Name} = Client, NodeName) ->
  +    case NodeName of
  +        _N = Name ->
  +            is_admin(Client);
  +        _Else ->
  +            false
  +    end.
  +
  +set_forbidden_msg(Req, State) ->
  +    Msg = <<"You are not allowed to take this action.">>,
  +    JsonMsg = ejson:encode({[{<<"error">>, [Msg]}]}),
  +    Req1 = wrq:set_resp_body(JsonMsg, Req),
  +    {Req1, State#base_state{log_msg = {forbidden}}}.
  +
  
positive.code:     Mod:malformed_request_message(Reason, Req, State).
  
  forbidden(Req, #base_state{resource_mod=Mod}=State) ->
      %% FIXME: add authorization logic for OSC
  
      %% For now we call auth_info because currently need the side-effect of looking up the
      %% record and returning 404.
      case Mod:auth_info(Req, State) of
          {{halt, _}, _, _} = Halt ->
              Halt;
          {_, Req1, State1} ->
              {false, Req1, State1}
      end.
  
  is_authorized(Req, State) ->
  
negative.code: maybe_authz_id(B) ->
      B.
  
  
  -spec authz_id(#chef_user{} | #chef_client{}) -> object_id().
  authz_id(#chef_client{authz_id = AuthzId}) ->
      AuthzId;
  