anchor.diff:                               resource_state = #client_state{client_data = Client}}) ->
       case wrq:method(Req) of
           'POST' -> %% create
  -            NotCreatingAdmin = ej:get({<<"admin">>}, Client) =/= true,
               IsAdmin = chef_wm_authz:is_admin(Requestor),
  +
               IsValidator = chef_wm_authz:is_validator(Requestor),
  -            case IsAdmin orelse (IsValidator andalso NotCreatingAdmin) of
  +            CreatingUnprivileged = (ej:get({<<"admin">>}, Client) =:= false) and
  +                (ej:get({<<"validator">>}, Client) =:= false),
  +
  +            %% Admins can create whatever they want, but validators can only create
  +            %% non-admin, non-validator clients
  +            case IsAdmin orelse
  +                (IsValidator andalso CreatingUnprivileged) of
                   true -> authorized;
                   false -> forbidden
               end;
  
positive.code:     NodeName = chef_wm_util:object_name(node, Req),
      case wrq:method(Req) of
          'GET' ->
              authorized;
          'PUT' -> %% update
              chef_wm_authz:allow_admin_or_requesting_node(Requestor, NodeName);
          'DELETE' -> %% delete
  
negative.code: handle_auth_info(chef_wm_named_data, Req, #base_state{requestor = Requestor}) ->
      case wrq:method(Req) of
          'GET' ->
              chef_wm_authz:all_but_validators(Requestor);
          'POST' -> %% create data_item
              chef_wm_authz:allow_admin(Requestor);
          'DELETE' -> %% delete data
  