anchor.diff:  object_type_to_container_name(environment) -> <<"environments">>;
   object_type_to_container_name(group)       -> <<"groups">>;
   object_type_to_container_name(node)        -> <<"nodes">>;
  +object_type_to_container_name(organization) -> <<"organizations">>;
   object_type_to_container_name(role)        -> <<"roles">>;
   object_type_to_container_name(sandbox)     -> <<"sandboxes">>;
   object_type_to_container_name(search)      -> <<"search">>;
   object_type_to_container_name(user)        -> <<"users">>.
   
  -%% @doc When creating a new Authz entity in a given container, we need to ensure we're
  -%% creating the correct kind.
  -authz_type_from_container(client)    -> 'actor';
  -authz_type_from_container(container) -> 'container';
  -authz_type_from_container(group)     -> 'group';
  -authz_type_from_container(user)      -> 'actor';
  -authz_type_from_container(_)         -> 'object'.
  +%% @doc The authz system needs to know the resource type as part of the API. This maps chef
  +%% object types into their appropriate authz resource types.
  +%%
  +%% When creating a new Authz entity in a given container, we need to ensure we're creating
  +%% the correct kind.
  +-spec object_type_to_resource(contained_object_name()) -> atom().
  +object_type_to_resource(client)    -> 'actor';
  +object_type_to_resource(container) -> 'container';
  +object_type_to_resource(group)     -> 'group';
  +object_type_to_resource(user)      -> 'actor';
  +object_type_to_resource(_)         -> 'object'.
   
   %
   % This exists for testing and debugging; it's too expensive for day to day use.
  
positive.code:          remove_ace_for_entity/6,
           add_ace_for_entity/6,
           set_ace_for_entity/5,
           superuser_id/0
          ]).
  
  -ifdef(TEST).
  
negative.code: create_entity_with_container_acl(RequestorId, ContainerAId, ObjectType) ->
  
      %% Create the entity
      AuthzType = object_type_to_resource(ObjectType),
      {ok, Id} = create_resource(RequestorId, AuthzType),
  
      %% Ensure it inherits the ACL of its container
  