anchor.diff:                                     [ContainerId, RequestorId, Error]),
               {error, container_acl}
       end.
  +
  +%% @doc Set the ACL of the object to the given ACL, one ACE at a time.
  +%%
  +%% Returns 'ok' if all ACEs are successfully set, and {error, Reason} at the first failure.
  +%%
  +%% No, this is not transactional in any sense, but then again, neither is CouchDB.  In any
  +%% case, this will change dramatically once we move to SQL.
  +-spec set_acl(requestor_id(),
  +              object_id(),
  +              authz_acl()) -> ok | {error, any()}.
  +set_acl(_RequestorId, _ObjectId, []) ->
  +    ok;
  +set_acl(RequestorId, ObjectId, [{Method, ACE}|Rest]) ->
  +    case set_ace_for_resource(RequestorId, object, ObjectId, Method, ACE) of
  +        ok ->
  +            set_acl(RequestorId, ObjectId, Rest);
  +        {error, Reason} ->
  +            error_logger:error_msg("Error setting ACE ~p for method ~p on object ~p for requestor ~p: ~p~n",
  +                                   [ACE, Method, ObjectId, RequestorId, Reason]),
  +            {error, Reason}
  +    end.
  +
   %
   % Test if an actor is authorized
   % Corresponds to GET /{actors|containers|groups|objects}/:id/acl/{actors|groups}/:member_id
   %
   -spec is_authorized_on_resource(requestor_id(), resource_type(), object_id(),
  -                              'actor'|'group', actor_id(), access_method())
  -                             -> true|false|{error,server_error}.
  +                                'actor'|'group', actor_id(), access_method())
  +                               -> true|false|{error,server_error}.
   is_authorized_on_resource(RequestorId, ResourceType, ResourceId, ActorType, ActorId, AccessMethod)
     when is_atom(ResourceType) and is_atom(ActorType) and is_atom(AccessMethod) ->
       Url = make_url([pluralize_resource(ResourceType), ResourceId, <<"acl">>,
  
positive.code: % Replace the actors and groups of an ace
  % PUT {objects|groups|actors|containers}/:id/acl/:action
  %
  -spec set_ace_for_resource(requestor_id(), resource_type(), binary(), access_method(), authz_ace()) -> ok|{error, any()}.
  set_ace_for_resource(RequestorId, ResourceType, Id, AccessMethod, #authz_ace{actors=Actors, groups=Groups}) ->
      Url = make_url([pluralize_resource(ResourceType), Id, acl, AccessMethod]),
      Body = jiffy:encode({[{<<"actors">>, Actors}, {<<"groups">>, Groups}]}),
  
negative.code: %% with the ACL for `ContainerAId' will be merged into the ACL for the new object.
  %%
  %% TODO: consider error cases in more detail
  -spec create_object_with_container_acl(requestor_id(), object_id()) -> {ok, object_id()} |
                                                                         {error, forbidden}.
  create_object_with_container_acl(RequestorId, ContainerAId) ->
      {ok, ObjectId} = create_resource(RequestorId, object),
      case merge_acl_from_container(RequestorId, ContainerAId, ObjectId) of
  