anchor.diff:      		Vis -> 
       		    CurrVis = case Id of 
       		                insert_rsc -> ?ACL_VIS_USER;
  -    		                _ -> m_rsc:p(Id, visible_for, Context)
  +    		                _ -> m_rsc:p_no_acl(Id, visible_for, Context)
       		              end,
       		    NewVis = z_convert:to_integer(Vis),
       		    case NewVis < CurrVis of
  
positive.code: observe({acl_is_allowed, insert, Cat}, Context) when is_atom(Cat) -> 
      can_insert(Cat, Context);
  observe({acl_is_allowed, update, Id}, Context) when is_integer(Id) ->
  	case m_rsc:p(Id, is_authoritative, Context) of
  		true -> can_edit(Id, Context);
  		_ -> undefined
  	end;
  
negative.code:     logon_roles(UserId, Roles, Context, ContextAdmin) ->
          RolesFiltered = [ R || R <- Roles, 
                                  m_rsc:is_a(R, acl_role, ContextAdmin),
                                  m_rsc:p_no_acl(R, is_published, ContextAdmin) ],
          % Merge all role's categories and modules
          ACLs = [ m_rsc:p_no_acl(R, acl, ContextAdmin) || R <- RolesFiltered ],
          {Cats, Mods, ViewAll, OnlyOwn, FileSize, FileMime, VisibleFor} 
                  = combine(ACLs, [], [], false, undefined, 0, [], 3),
          Context#context{user_id=UserId,
  