anchor.diff:  %% with the different resource_state records).
   create_in_container(Container, Req, #base_state{chef_authz_context = AuthzContext,
                                                   organization_guid = OrgId,
  -                                                requestor = Requestor,
  +                                                requestor_id = RequestorId,
                                                   resource_state = RS} = State) ->
  -    #chef_requestor{authz_id = RequestorId} = Requestor,
       case chef_authz:create_object_if_authorized(AuthzContext, OrgId, RequestorId,
                                                   Container) of
           {ok, AuthzId} ->
  
positive.code: %% we add a user to the org, and then disassociate them, there will be
  %% acls left behind granting permissions on the org objects, so we
  %% must check user association and permissions
  authorized_by_org_membership_check(Req, #base_state{requester_type=client}=State) ->
      {true, Req, State};
  authorized_by_org_membership_check(Req, State = #base_state{organization_name = OrgName,
                                                              chef_db_context = DbContext}) ->
  
negative.code:                     {Req2, State2} = set_forbidden_msg(Permission, Req1, State1),
                      {true, Req2, State2};
                  {Error, {AuthzObjectType, AuthzId, Permission}} ->
                      #base_state{requestor_id=RequestorId} = State1,
                      %% TODO: Extract this logging message, as it is used elsewhere, too
                      error_logger:error_msg("is_authorized_on_resource failed (~p, ~p, ~p): ~p~n",
                                             [Permission, {AuthzObjectType, AuthzId}, RequestorId, Error]),
  