anchor.diff:  create_entity_with_container_acl(RequestorId, ContainerAId, ObjectType) ->
   
       %% Create the entity
  -    AuthzType = authz_type_from_container(ObjectType),
  +    AuthzType = object_type_to_resource(ObjectType),
       {ok, Id} = create_resource(RequestorId, AuthzType),
   
       %% Ensure it inherits the ACL of its container
  
positive.code:          remove_ace_for_entity/6,
           add_ace_for_entity/6,
           set_ace_for_entity/5,
           superuser_id/0
          ]).
  
  -ifdef(TEST).
  
negative.code: object_type_to_container_name(environment) -> <<"environments">>;
  object_type_to_container_name(group)       -> <<"groups">>;
  object_type_to_container_name(node)        -> <<"nodes">>;
  object_type_to_container_name(organization) -> <<"organizations">>;
  object_type_to_container_name(role)        -> <<"roles">>;
  object_type_to_container_name(sandbox)     -> <<"sandboxes">>;
  object_type_to_container_name(search)      -> <<"search">>;
  object_type_to_container_name(user)        -> <<"users">>.
  
  %% @doc The authz system needs to know the resource type as part of the API. This maps chef
  %% object types into their appropriate authz resource types.
  %%
  %% When creating a new Authz entity in a given container, we need to ensure we're creating
  %% the correct kind.
  -spec object_type_to_resource(contained_object_name()) -> atom().
  object_type_to_resource(client)    -> 'actor';
  object_type_to_resource(container) -> 'container';
  object_type_to_resource(group)     -> 'group';
  object_type_to_resource(user)      -> 'actor';
  object_type_to_resource(_)         -> 'object'.
  
  %
  % This exists for testing and debugging; it's too expensive for day to day use.
  