anchor.diff:      Filtered = remove_actor_from_ace(ActorId, Ace),
       remove_actor_from_acl(ActorId, Rest, [{Permission, Filtered} | Acc]).
   
  -%% @doc Returns the given authz_ace with `ActorId` filtered out of the `actors` lists.  The
  -%% `groups` list is untouched.
  +%% @doc Returns the given authz_ace with `ActorId' filtered out of the `actors' list.  The
  +%% `groups' list is untouched.
   -spec remove_actor_from_ace(ActorId::object_id(), Ace::#authz_ace{}) -> #authz_ace{}.
   remove_actor_from_ace(ActorId, #authz_ace{actors=Actors, groups=Groups}) ->
       #authz_ace{actors=[A || A <- Actors, A /= ActorId],
  
positive.code: -export([
           add_client_to_clients_group/3,
           delete_resource/3,
           create_object_if_authorized/4,
           get_container_aid_for_object/3,
           make_context/1,
           is_authorized_on_resource/6,
  
negative.code: object_type_to_container_name(role)        -> <<"roles">>;
  object_type_to_container_name(sandbox)     -> <<"sandboxes">>;
  object_type_to_container_name(search)      -> <<"search">>.
  
  %% @doc When creating a new Authz entity in a given container, we need to ensure we're
  %% creating the correct kind.
  -spec authz_type_from_container(contained_object_name()) -> 'actor' | 'object'.
  authz_type_from_container(client) -> 'actor';
  authz_type_from_container(_)      -> 'object'.
  
  %
  % This exists for testing and debugging; it's too expensive for day to day use.
  