anchor.diff:          {{container, Container}, Req1, State1} ->
               ContainerId = fetch_container_id(Container, Req1, State1),
               invert_perm(check_permission(container, ContainerId, Req1, State1));
  -        {{object, ObjectId}, Req1, State1} ->
  -            invert_perm(check_permission(object, ObjectId, Req1, State1));
  +        {{Type, ObjectId}, Req1, State1} when Type =:= object;
  +                                              Type =:= actor ->
  +            invert_perm(check_permission(Type, ObjectId, Req1, State1));
           {AuthTuples, Req1, State1} when is_list(AuthTuples)->
               %% NOTE: multi_auth_check does not handle create_in_container yet, and expects
               %% each auth tuple to have a permission.  This code path is currently only used
  
positive.code: stats_hero_upstreams() ->
      [<<"authz">>, <<"couchdb">>, <<"rdbms">>, <<"s3">>, <<"solr">>].
  
  
negative.code:                                           type = Type,
                                            authz_id = AuthzId} = _Principal,
                           OrgName, DbContext) ->
      Member = is_user_in_org(Type, DbContext, Name, OrgName),
      {[{<<"name">>, Name},
        {<<"public_key">>, PublicKey},
        {<<"type">>, Type},
  