anchor.diff:      ?SERVICE(OpService, ProviderId) = RequestContext#request_context.service,
       ProviderToken = ozt_tokens:create(temporary, ?SUB(?ONEPROVIDER, ProviderId)),
       OpServiceToken = tokens:add_oneprovider_service_indication(OpService, ozt_tokens:ensure_serialized(ProviderToken)),
  +    ConsumerToken = case get_consumer_token_for_request(RequestContext) of
  +        undefined -> undefined;
  +        Token -> ozt_tokens:ensure_serialized(Token)
  +    end,
       AuthOverride = #auth_override{
           client_auth = ozt_gs:normalize_client_auth(ClientAuth),
           interface = RequestContext#request_context.interface,
           peer_ip = RequestContext#request_context.ip,
  -        consumer_token = case get_consumer_token_for_request(RequestContext) of
  -            undefined -> undefined;
  -            Token -> ozt_tokens:ensure_serialized(Token)
  +        consumer_token = case RequestContext#request_context.consumer of
  +            ?SUB(?ONEPROVIDER, ProviderId) ->
  +                % If the requesting Oneprovider is the same as the target consumer, test also
  +                % the possibility of becoming the consumer implicitly without presenting a token
  +                % (which is the default behaviour on the GS channel with auth override).
  +                lists_utils:random_element([undefined, ConsumerToken]);
  +            _ ->
  +                ConsumerToken
           end,
           data_access_caveats_policy = RequestContext#request_context.data_access_caveats_policy
       },
  
positive.code:         ?SUB(CType, _) -> CType
      end,
      DataAccessCaveatsPolicy = RequestContext#request_context.data_access_caveats_policy,
      case {PeerIp, Interface} of
          {undefined, _} -> [logic];
          {_, undefined} -> [logic];
          {_, rest} -> methods_for_rest_ctx(SubjectType, ServiceType, ConsumerType, DataAccessCaveatsPolicy);
          {_, oneclient} -> methods_for_oneclient_ctx(SubjectType, ServiceType, ConsumerType, DataAccessCaveatsPolicy);
          {_, graphsync} -> methods_for_graphsync_ctx(SubjectType, ServiceType, ConsumerType, DataAccessCaveatsPolicy)
      end.
  
  
  
negative.code:                 RandCorrectCaveats = lists_utils:random_sublist(gen_correct_caveats(RequestSpec, RequestContext)),
                  RandUnverifiedCaveats = lists_utils:random_sublist(gen_unverified_caveats(RequestSpec, RequestContext)),
                  ClientAuth = gen_client_auth(EligibleSubject, Persistence, RandCorrectCaveats ++ RandUnverifiedCaveats),
                  % force entity graph reconciliation as some tests depend on
                  % effective memberships/privileges in groups/spaces etc,
                  % and some of these may be set up during caveats generation and be not yet recomputed
                  ozt:reconcile_entity_graph(),
                  Result = make_request(RequestSpec, RequestContext, ClientAuth),
                  % These tests cover only a subset of combinations and possibly
                  % there are some combinations wrongly handled by the test framework
  