anchor.diff:      {create_object(OrgId, RequestorId, container, List, Cache), []};
   process_policy_step({set_acl_expanded, Object, Acl},
                       #mover_org{}, #mover_requestor{authz_id=_RequestorId}, Cache) ->
  -    {ResourceType, AuthzId} = find(Object, Cache),
  -    Acl1 = [{Action, ace_to_authz(Cache, ACE)} || {Action, ACE} <- Acl],
  -    %% TODO: Error check authz results
  -    %% FURTHER TODO: this probably won't work with our hacked ace records :'(
  -    [ mv_oc_chef_authz:set_ace_for_entity(superuser, ResourceType, AuthzId, Method, ACE) ||
  -        {Method, ACE} <- Acl1],
  -    {Cache, []};
  +    case  find(Object, Cache) of
  +        {_, not_found} ->
  +            {Cache, []};
  +        {ResourceType, AuthzId} ->
  +            Acl1 = [{Action, ace_to_authz(Cache, ACE)} || {Action, ACE} <- Acl],
  +            %% TODO: Error check authz results
  +            %% FURTHER TODO: this probably won't work with our hacked ace records :'(
  +            [ mv_oc_chef_authz:set_ace_for_entity(superuser, ResourceType, AuthzId, Method, ACE) ||
  +                {Method, ACE} <- Acl1 ],
  +            {Cache, []}
  +    end;
   process_policy_step({acls, Steps}, _Org, _User, Cache) ->
       {Cache, process_acls(Steps)}.
   
  
positive.code:            {add_acl, [{container, cookbook_artifacts}], [create, read, update, delete, grant], [{user, creator}]},
  
             %% Admins
             {add_acl, [{container, policies}],           [create, read, update, delete, grant], [{group, users}]},
             {add_acl, [{container, policy_groups}],      [create, read, update, delete, grant], [{group, users}]},
             {add_acl, [{container, cookbook_artifacts}], [create, read, update, delete, grant], [{group, users}]},
  
  
             %% users
  
negative.code: 
  set(Key, Value, C) ->
      dict:store(Key,Value, C).
  find(Key, C) ->
      case dict:find(Key,C) of
          {ok, Value} -> Value;
  