anchor.diff:      Container = oc_chef_authz_db:fetch_container(Context, OrgId, ContainerName),
       Container#chef_container.authz_id.
   
  -%% @doc Create a new authz object using the ACL of a container as a template for the new
  -%% object's ACL.
  +%% @doc Create a new Authz entity using the ACL of a container as a template for the new
  +%% entity's ACL.
   %%
   %% `RequestorId' will have all permissions on the new object.  The permissions associated
   %% with the ACL for `ContainerAId' will be merged into the ACL for the new object.
   %%
  -%% TODO: consider error cases in more detail
  --spec create_object_with_container_acl(requestor_id(), object_id()) -> {ok, object_id()} |
  -                                                                       {error, forbidden}.
  -create_object_with_container_acl(RequestorId, ContainerAId) ->
  -    {ok, ObjectId} = create_resource(RequestorId, object),
  -    case merge_acl_from_container(RequestorId, ContainerAId, ObjectId) of
  +%% @end TODO: consider error cases in more detail
  +-spec create_entity_with_container_acl(RequestorId::requestor_id(),
  +                                       ContainerAId::object_id(),
  +                                       ObjectType :: contained_object_name()) -> {ok, object_id()} |
  +                                                                                 {error, forbidden}.
  +create_entity_with_container_acl(RequestorId, ContainerAId, ObjectType) ->
  +
  +    %% Create the entity
  +    AuthzType = authz_type_from_container(ObjectType),
  +    {ok, Id} = create_resource(RequestorId, AuthzType),
  +
  +    %% Ensure it inherits the ACL of its container
  +    case merge_acl_from_container(RequestorId, ContainerAId, AuthzType, Id) of
           ok ->
  -            {ok, ObjectId};
  +            {ok, Id};
           {error, object_acl} ->
  -            error_logger:error_msg("Unable to read ACL for newly created resource: ~p~n", [ObjectId]),
  +            error_logger:error_msg("Unable to read ACL for newly created ~p: ~p~n", [ObjectType, Id]),
               {error, forbidden};
  -        _Error ->
  +        Error ->
  +            error_logger:error_msg("Error encountered when trying to merge container ACL: ~p~n", [Error]),
               {error, forbidden}
       end.
   
  -%%%
  -%%% merge_acl_from_container
  -%%% TODO: consider error cases in more detail
  --spec merge_acl_from_container(requestor_id(), object_id(), object_id()) -> ok |
  -                                                                            {error, object_acl | container_acl}.
  -merge_acl_from_container(RequestorId, ContainerId, ObjectId) ->
  +%% @doc Merges the ACL of an entity's container with the ACL of the entity itself.
  +%%
  +%% Currently is only used for actors and objects, since those are the only kinds of Authz
  +%% entities we currently create via Erchef.
  +%%
  +%% Nothing in this method checks that the `ContainerId' and the `ObjectId' correspond
  +%% properly (e.g., that an object id that represents a Node implies that the container id is
  +%% that of the organization's node container).  That correspondence is assumed to have been
  +%% verified elsewhere.
  +%%
  +%% @end TODO: consider error cases in more detail
  +-spec merge_acl_from_container(requestor_id(),
  +                               ContainerId :: object_id(),
  +                               AuthzType :: 'actor' | 'object',
  +                               ObjectId :: object_id()) -> ok |
  +                                                           {error, object_acl | container_acl}.
  +merge_acl_from_container(RequestorId, ContainerId, AuthzType, ObjectId) ->
       case get_acl_for_resource(RequestorId, container, ContainerId) of
           {ok, CAcl} ->
  -            case get_acl_for_resource(RequestorId, object, ObjectId) of
  +            case get_acl_for_resource(RequestorId, AuthzType, ObjectId) of
                   {ok, OAcl} ->
                       NAcl = merge_acl(CAcl, OAcl),
  -                    case set_acl(RequestorId, ObjectId, NAcl) of
  +                    case set_acl(RequestorId, AuthzType, ObjectId, NAcl) of
                           ok ->
                               ok;
                           {error, _} ->
  
positive.code:             {error, container_acl}
      end.
  
  %% @doc Set the ACL of the object to the given ACL, one ACE at a time.
  %%
  %% Returns 'ok' if all ACEs are successfully set, and {error, Reason} at the first failure.
  %%
  %% No, this is not transactional in any sense, but then again, neither is CouchDB.  In any
  %% case, this will change dramatically once we move to SQL.
  -spec set_acl(requestor_id(),
                object_id(),
                authz_acl()) -> ok | {error, any()}.
  set_acl(_RequestorId, _ObjectId, []) ->
      ok;
  set_acl(RequestorId, ObjectId, [{Method, ACE}|Rest]) ->
      case set_ace_for_object(RequestorId, ObjectId, Method, ACE) of
          ok ->
              set_acl(RequestorId, ObjectId, Rest);
          {error, Reason} ->
              error_logger:error_msg("Error setting ACE ~p for method ~p on object ~p for requestor ~p: ~p~n",
                                     [ACE, Method, ObjectId, RequestorId, Reason]),
              {error, Reason}
      end.
  
  
negative.code: -export([
           add_client_to_clients_group/3,
           delete_resource/3,
           create_entity_if_authorized/4,
           get_container_aid_for_object/3,
           make_context/1,
           is_authorized_on_resource/6,
  