anchor.diff:  is_acl_request(_) ->
       false.
   
  +-type halt_or_bool() :: {halt, pos_integer()} | boolean().
  +-type authorized_response() :: {halt_or_bool(), RD :: term(), Ctx :: term()}.
   -spec object_access_authorize_helper(AccessType::atom(), boolean(),
  -                                     RD::term(), Ctx::term()) -> term().
  +                                     RD::term(), Ctx::term()) ->
  +    authorized_response().
   object_access_authorize_helper(AccessType, Deletable,
                                  RD, #context{user=User,
                                               policy_module=PolicyMod,
  
positive.code:                                    RiakPid),
            PolicyMod:eval(Access, Policy)} of
  
          {true, false} when Method =:= 'PUT' orelse
                             (Deletable andalso Method =:= 'DELETE') ->
              %% actor is the owner
              AccessRD = riak_cs_access_log_handler:set_user(User, RD),
  
              riak_cs_wm_utils:deny_access(AccessRD, Ctx);
          {true, false} when Method =:= 'GET' orelse
                             (Deletable andalso Method =:= 'HEAD') ->
              {{halt, 404}, riak_cs_access_log_handler:set_user(Ctx#context.user, RD), Ctx};
  
          {true, _} ->
              %% actor is the owner
              AccessRD = riak_cs_access_log_handler:set_user(User, RD),
              UserStr = User?RCS_USER.canonical_id,
              UpdLocalCtx = LocalCtx#key_context{owner=UserStr},
              {false, AccessRD, Ctx#context{local_context=UpdLocalCtx}};
  
          {{true, OwnerId}, false} when Method =:= 'PUT' orelse
                                        (Deletable andalso Method =:= 'DELETE') ->
              %% actor is not the owner
              AccessRD = riak_cs_access_log_handler:set_user(OwnerId, RD),
              riak_cs_wm_utils:deny_access(AccessRD, Ctx);
  
          {{true, _OwnerId}, false} when Method =:= 'GET' orelse
                                         (Deletable andalso Method =:= 'HEAD') ->
              {{halt, 404}, RD, Ctx};
  
          {{true, OwnerId}, _} ->
              %% actor is not the owner
              AccessRD = riak_cs_access_log_handler:set_user(OwnerId, RD),
              UpdLocalCtx = LocalCtx#key_context{owner=OwnerId},
              {false, AccessRD, Ctx#context{local_context=UpdLocalCtx}};
  
          {false, true} ->
              %% actor is not the owner, not permitted by ACL but permitted by policy
              OwnerId = riak_cs_acl:owner_id(ObjectAcl, RiakPid),
              AccessRD = riak_cs_access_log_handler:set_user(OwnerId, RD),
              UpdLocalCtx = LocalCtx#key_context{owner=OwnerId},
              {false, AccessRD, Ctx#context{local_context=UpdLocalCtx}};
  
          {false, _} -> % policy says undefined or false
              %% ACL check failed, deny access
              riak_cs_wm_utils:deny_access(RD, Ctx)
      end.
  
  %% ===================================================================
  %% Internal functions
  
negative.code:        andalso is_boolean(Deletable) ->
  
      Method = wrq:method(RD),
      #key_context{bucket=Bucket, manifest=Manifest} = LocalCtx,
      CanonicalId = extract_canonical_id(User),
      RequestedAccess = requested_access_helper(AccessType, Method),
      ObjectAcl = extract_object_acl(Manifest),
      Policy = translate_bucket_policy(PolicyMod, Bucket, RiakPid),
      Access = PolicyMod:reqdata_to_access(RD, AccessType, CanonicalId),
  
      case {riak_cs_acl:object_access(Bucket,
  