anchor.diff:  
   gen_unverified_caveats(RequestSpec, RC) -> lists:flatten([
       #cv_time{valid_until = RC#request_context.current_timestamp - 1},
  -    case gen_unverified_service_caveat(RC) of
  +    case gen_unverified_service_caveat(RequestSpec, RC) of
           undefined -> [];
           ServiceCaveat -> ServiceCaveat
       end,
  
positive.code:     eligible_subjects :: [aai:subject()],
      operation :: entity_logic:operation(),
      gri :: gri:gri(),
      % Specifies if such operation is available if the auth token contains a data_access_caveat
      available_with_data_access_caveats :: boolean(),
      % Args should typically start with 'auth' atom, which is substituted for client's auth
  
negative.code:         eligible_subjects = [?SUB(user, UserId)],
          operation = get,
          gri = ?GRI(od_group, GroupId, instance, protected),
          services_allowed_to_call_this_api = [?OZ_WORKER, ?OP_WORKER],
          available_with_data_access_caveats = false,
          logic_call_args = {group_logic, get_protected_data, [auth, GroupId]},
          rest_call_args = {get, [<<"/groups/">>, GroupId], #{}},
  