anchor.diff:              end
       end.
   
  +forbidden_perm(Req, State) ->
  +    Perm = http_method_to_authz_perm(Req),
  +    Msg = iolist_to_binary(["missing ", atom_to_binary(Perm, utf8), " permission"]),
  +    JsonMsg = ejson:encode({[{<<"error">>, [Msg]}]}),
  +    Req1 = wrq:set_resp_body(JsonMsg, Req),
  +    {true, Req1, State#base_state{log_msg = {Perm, forbidden}}}.
  +
   forbidden_message(not_member_of_org, User, Org) ->
       Msg = iolist_to_binary([<<"'">>, User, <<"' not associated with organization '">>,
                               Org, <<"'">>]),
  
positive.code: forbidden(Req, #base_state{resource_mod=Mod}=State) ->
      case Mod:auth_info(Req, State) of
          {{halt, 403}, Req1, State1} ->
              Perm = http_method_to_authz_perm(wrq:method(Req)),
              Msg = iolist_to_binary(["missing ", atom_to_binary(Perm, utf8),
                                      " permission"]),
              JsonMsg = ejson:encode({[{<<"error">>, [Msg]}]}),
              Req1 = wrq:set_resp_body(JsonMsg, Req),
              {true, Req1, State1#base_state{log_msg = {Perm, forbidden}}};
          {{halt, Code}, Req1, State1} ->
              {{halt, Code}, Req1, State1};
          {container, ContainerId, Req1, State1} ->
  
negative.code: check_permission(AuthzObjectType, AuthzId, Req, #base_state{reqid=ReqId,
                                                              requestor=Requestor}=State) ->
      #chef_requestor{authz_id = RequestorId} = Requestor,
      Perm = http_method_to_authz_perm(Req),
      case ?SH_TIME(ReqId, chef_authz, is_authorized_on_resource,
                    (RequestorId, AuthzObjectType, AuthzId, actor, RequestorId, Perm)) of
          true ->
              {true, Req, State};
          false ->
              forbidden_perm(Req, State);
          Error ->
              error_logger:error_msg("is_authorized_on_resource failed (~p, ~p, ~p): ~p~n",
                                     [Perm, {AuthzObjectType, AuthzId}, RequestorId, Error]),
  