anchor.diff:  -export([
            add_client_to_clients_group/3,
            delete_resource/3,
  -         create_object_if_authorized/4,
  +         create_entity_if_authorized/4,
            get_container_aid_for_object/3,
            make_context/1,
            is_authorized_on_resource/6,
  
positive.code: object_type_to_container_name(role)        -> <<"roles">>;
  object_type_to_container_name(sandbox)     -> <<"sandboxes">>;
  object_type_to_container_name(search)      -> <<"search">>.
  
  %
  % This exists for testing and debugging; it's too expensive for day to day use.
  
negative.code: % PUT {objects|groups|actors|containers}/:id/acl/:action
  %
  -spec set_ace_for_object(requestor_id(),
                           AuthzType :: 'actor' | 'container' | 'object',
                           object_id(),
                           access_method(),
                           authz_ace()) -> ok |
                                           {error, any()}.
  set_ace_for_object(RequestorId, AuthzType, Id, AccessMethod, #authz_ace{actors=Actors, groups=Groups}) ->
      Url = make_url([pluralize_resource(AuthzType), Id, acl, AccessMethod]),
      Body = jiffy:encode({[{<<"actors">>, Actors}, {<<"groups">>, Groups}]}),
      case oc_chef_authz_http:request(Url, put, [], Body, RequestorId) of
          ok -> ok;
  