anchor.diff:          ok ->
               case add_revoke_int([all], Bucket, revokes, Meta) of
                   {ok, NewMeta} ->
  -                    put_meta(NewMeta),
  +                    put_meta(stash(epoch, {epoch, os:timestamp()}, NewMeta)),
                       ok;
                   Error2 ->
                       Error2
  
positive.code:     case Valid2 of
          ok ->
              %% add a source for each user
              put_meta(add_grant_int(UserList, Bucket, Grants, Meta)),
              ok;
          Error ->
              Error
  
negative.code:                 [[Username, io_lib:format("~p", [Options])] ||
              {Username, Options} <- Users]).
  
  %% Contexts are only valid until the GRANT epoch changes, and it will change
  %% whenever a GRANT or a REVOKE is performed. This is a little coarse grained
  %% right now, but it'll do for the moment.
  get_context(Username, Meta) ->
      Grants = lookup(Username, lookup(grants, Meta, []), []),
      Revokes = lookup(Username, lookup(revokes, Meta, []), []),
      {Username, Grants, Revokes, lookup(epoch, Meta)}.
  
  check_permission(Permission, Bucket, Context) ->
      Meta = get_meta(),
      Epoch = lookup(epoch, Meta),
      {Username, Grants, Revokes, CtxEpoch} = Context,
      case Epoch == CtxEpoch of
          false ->
              %% context has expired
              check_permission(Permission, Bucket, get_context(Username, Meta));
          true ->
              %% TODO check context is still valid
              case match_grant(Bucket, Grants) of
                  {B, MatchG} ->
                      case MatchG /= undefined andalso
                          (lists:member(Permission, MatchG) orelse MatchG == 'all') of
                          true ->
                              %% ok, permission is present, check for revokes
                              MatchR = lookup(B, Revokes, undefined),
                              case MatchR /= undefined andalso
                                  (lists:member(Permission, MatchR) orelse MatchR == 'all') of
                                  true ->
                                      %% oh snap, it was revoked
                                      {false, Context};
                                  false ->
                                      %% not revoked, yay
                                      {true, Context}
                              end;
                          false ->
                              %% no applicable grant
                              {false, Context}
                      end;
                  undefined ->
                      %% no grants for this user at all
                      {false, Context}
              end
      end.
  
  get_username({Username, _Grants, _Revokes, _Expiry}) ->
  