anchor.diff:  make_context(ReqId)  ->
       oc_chef_authz_db:make_context(ReqId).
   
  -%%%
  -%%% Takes a Creator authz id,  an object type atom and an OrgId and
  -%%% creates the authz permissions for the object if the creator is permitted
  -%%% otherwise returns {error, forbidden}
  -%%%
  --spec create_object_if_authorized(oc_chef_authz_context(),
  -                                  object_id(),
  -                                  object_id(),
  -                                  contained_object_name()) ->
  +%% @doc Creates a new Authz entity, if the requestor has the necessary permissions.
  +%%
  +%% `CreatorAId' is the Authz ID of the actor that wishes to create the entity. `ObjectType'
  +%% is used to determine what kind of Authz entity should be created (e.g., a client should
  +%% be an actor, while a node should be an object, etc.).
  +%%
  +%% If the permissions are in place, the Authz ID of the newly-created entity is returned.
  +-spec create_entity_if_authorized(oc_chef_authz_context(),
  +                                  OrgId :: object_id(),
  +                                  CreatorAId :: object_id(),
  +                                  ObjectType :: contained_object_name()) ->
                                            {ok, object_id()} |
                                            {error, forbidden}.
  -create_object_if_authorized(Context, OrgId, CreatorAId, ObjectType) ->
  +create_entity_if_authorized(Context, OrgId, CreatorAId, ObjectType) ->
       ContainerAId = get_container_aid_for_object(Context, OrgId, ObjectType),
       case is_authorized_on_resource(CreatorAId, container, ContainerAId, actor, CreatorAId, create) of
           false -> {error, forbidden};
           true ->
  -            create_object_with_container_acl(CreatorAId, ContainerAId)
  +            create_entity_with_container_acl(CreatorAId, ContainerAId, ObjectType)
       end.
   
   %%%
  
positive.code: object_type_to_container_name(role)        -> <<"roles">>;
  object_type_to_container_name(sandbox)     -> <<"sandboxes">>;
  object_type_to_container_name(search)      -> <<"search">>.
  
  %
  % This exists for testing and debugging; it's too expensive for day to day use.
  
negative.code: % PUT {objects|groups|actors|containers}/:id/acl/:action
  %
  -spec set_ace_for_object(requestor_id(),
                           AuthzType :: 'actor' | 'container' | 'object',
                           object_id(),
                           access_method(),
                           authz_ace()) -> ok |
                                           {error, any()}.
  set_ace_for_object(RequestorId, AuthzType, Id, AccessMethod, #authz_ace{actors=Actors, groups=Groups}) ->
      Url = make_url([pluralize_resource(AuthzType), Id, acl, AccessMethod]),
      Body = jiffy:encode({[{<<"actors">>, Actors}, {<<"groups">>, Groups}]}),
      case oc_chef_authz_http:request(Url, put, [], Body, RequestorId) of
          ok -> ok;
  