anchor.diff:      {create_object(OrgId, RequestorId, container, List, Cache), []};
   process_policy_step({set_acl_expanded, Object, Acl},
                       #mover_org{}, #mover_requestor{authz_id=_RequestorId}, Cache) ->
  -    {ResourceType, AuthzId} = find(Object, Cache),
  -    Acl1 = [{Action, ace_to_authz(Cache, ACE)} || {Action, ACE} <- Acl],
  -    %% TODO: Error check authz results
  -    %% FURTHER TODO: this probably won't work with our hacked ace records :'(
  -    [ mv_oc_chef_authz:set_ace_for_entity(superuser, ResourceType, AuthzId, Method, ACE) ||
  -        {Method, ACE} <- Acl1],
  -    {Cache, []};
  +    case  find(Object, Cache) of
  +        {_, not_found} ->
  +            {Cache, []};
  +        {ResourceType, AuthzId} ->
  +            Acl1 = [{Action, ace_to_authz(Cache, ACE)} || {Action, ACE} <- Acl],
  +            %% TODO: Error check authz results
  +            %% FURTHER TODO: this probably won't work with our hacked ace records :'(
  +            [ mv_oc_chef_authz:set_ace_for_entity(superuser, ResourceType, AuthzId, Method, ACE) ||
  +                {Method, ACE} <- Acl1 ],
  +            {Cache, []}
  +    end;
   process_policy_step({acls, Steps}, _Org, _User, Cache) ->
       {Cache, process_acls(Steps)}.
   
  
positive.code: 
  set(Key, Value, C) ->
      dict:store(Key,Value, C).
  
  find(Key, C) ->
      case dict:find(Key,C) of
          {ok, Value} -> Value;
  
negative.code: %% * oc_chef_authz (maybe?)
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  upgrade_org(#mover_org{superuser = CreatingUser} = Org) ->
      Cache = init_cache(Org, CreatingUser),
      CacheWithGroups = prepopulate_groups(Cache, Org),
      process_policy(?ORG_POLICY_FOR_POLICIES_CONTAINERS, Org, CreatingUser, CacheWithGroups).
  
  prepopulate_groups(Cache, Org) ->
      % Failure is arguably okay if we can't set up admins acls
      % but we can't continue if we can't set it up for clients and users.
      Cache1 = prepopulate_group(Cache, Org, admins),
      Cache2 = prepopulate_group(Cache1, Org, users),
      prepopulate_group(Cache2, Org, clients).
  
  prepopulate_group(Cache, #mover_org{id = OrgId, name = OrgName}, Group) ->
      {ok, Results} = sqerl:adhoc_select([name, authz_id, org_id],
                                         groups,
                                         {'and', [{name, equals, Group}, {org_id, equals, OrgId}]}),
      case Results of
          [] ->
              lager:warning("Could not find group '~p' for org '~s'", [Group, OrgName]),
              add_cache(Cache,{group, Group}, not_found);
          _ ->
              GroupFieldsList = hd(Results),
              {<<"authz_id">>, AuthzId} = proplists:lookup(<<"authz_id">>, GroupFieldsList),
              add_cache(Cache,{group, Group}, AuthzId)
      end.
  
  %%
  