anchor.diff:                   RecType, {authz_id, AuthzId}, ObjectEjson) ->
       %% ObjectEjson should already be normalized. Record creation does minimal work and does
       %% not add or update any fields.
  -    ObjectRec = chef_object:new_record(RecType, OrgId, AuthzId, ObjectEjson,
  +    ObjectRec = chef_object:new_record(RecType, OrgId, maybe_authz_id(AuthzId), ObjectEjson,
                                          DbType),
       Id = chef_object:id(ObjectRec),
       Name = chef_object:name(ObjectRec),
  
positive.code: %% objects. `OrigObjectRec' should be the existing and unmodified `chef_object()'
  %% record. `ObjectEjson' is the parsed EJSON from the request body.
  update_from_json(#wm_reqdata{} = Req, #base_state{chef_db_context = DbContext,
                                    organization_guid = OrgId,
                                    requestor = #chef_requestor{authz_id = ActorId},
                               db_type = DbType}=State, OrigObjectRec, ObjectEjson) ->
      ObjectRec = chef_object:update_from_ejson(OrigObjectRec, ObjectEjson, DbType),
      %% Send object to solr for indexing *first*. If the update fails, we will have sent
      %% incorrect data, but that should get corrected when the client retries. This is a
  
negative.code: malformed_request_message(Reason, Req, #base_state{resource_mod=Mod}=State) ->
      Mod:malformed_request_message(Reason, Req, State).
  
  forbidden(Req, #base_state{resource_mod=Mod}=State) ->
      %% FIXME: add authorization logic for OSC
  
      %% For now we call auth_info because currently need the side-effect of looking up the
      %% record and returning 404.
      case Mod:auth_info(Req, State) of
          {{halt, _}, _, _} = Halt ->
              Halt;
          {_, Req1, State1} ->
              {false, Req1, State1}
      end.
  
  is_authorized(Req, State) ->
      case verify_request_signature(Req, State) of
  