diff --git a/scripts/differential/detect_copied_code.php b/scripts/differential/detect_copied_code.php
deleted file mode 100755
index 1db5c0e76f..0000000000
--- a/scripts/differential/detect_copied_code.php
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/usr/bin/env php
-<?php
-
-$root = dirname(dirname(dirname(__FILE__)));
-require_once $root.'/scripts/__init_script__.php';
-
-if ($argc != 3 || !is_numeric($argv[1]) || !is_numeric($argv[2])) {
-  echo "Usage: {$argv[0]} <diff_id_from> <diff_id_to>\n";
-  exit(1);
-}
-list(, $from, $to) = $argv;
-
-for ($diff_id = $from; $diff_id <= $to; $diff_id++) {
-  echo "Processing $diff_id";
-  $diff = id(new DifferentialDiff())->load($diff_id);
-  if ($diff) {
-    $diff->attachChangesets($diff->loadChangesets());
-    $orig_copy = array();
-    foreach ($diff->getChangesets() as $i => $changeset) {
-      $orig_copy[$i] = idx((array)$changeset->getMetadata(), 'copy:lines');
-      $changeset->attachHunks($changeset->loadHunks());
-    }
-    $diff->detectCopiedCode();
-    foreach ($diff->getChangesets() as $i => $changeset) {
-      if (idx($changeset->getMetadata(), 'copy:lines') || $orig_copy[$i]) {
-        echo ".";
-        $changeset->save();
-      }
-    }
-  }
-  echo "\n";
-}
-
-echo "Done.\n";
diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php
index 4a5f79fc7e..f1cfdf6336 100644
--- a/src/__phutil_library_map__.php
+++ b/src/__phutil_library_map__.php
@@ -345,6 +345,7 @@ phutil_register_library_map(array(
     'DifferentialDiffContentMail' => 'applications/differential/mail/DifferentialDiffContentMail.php',
     'DifferentialDiffCreateController' => 'applications/differential/controller/DifferentialDiffCreateController.php',
     'DifferentialDiffProperty' => 'applications/differential/storage/DifferentialDiffProperty.php',
+    'DifferentialDiffQuery' => 'applications/differential/query/DifferentialDiffQuery.php',
     'DifferentialDiffTableOfContentsView' => 'applications/differential/view/DifferentialDiffTableOfContentsView.php',
     'DifferentialDiffTestCase' => 'applications/differential/storage/__tests__/DifferentialDiffTestCase.php',
     'DifferentialDiffViewController' => 'applications/differential/controller/DifferentialDiffViewController.php',
@@ -2245,10 +2246,15 @@ phutil_register_library_map(array(
     'DifferentialDefaultFieldSelector' => 'DifferentialFieldSelector',
     'DifferentialDependenciesFieldSpecification' => 'DifferentialFieldSpecification',
     'DifferentialDependsOnFieldSpecification' => 'DifferentialFieldSpecification',
-    'DifferentialDiff' => 'DifferentialDAO',
+    'DifferentialDiff' =>
+    array(
+      0 => 'DifferentialDAO',
+      1 => 'PhabricatorPolicyInterface',
+    ),
     'DifferentialDiffContentMail' => 'DifferentialMail',
     'DifferentialDiffCreateController' => 'DifferentialController',
     'DifferentialDiffProperty' => 'DifferentialDAO',
+    'DifferentialDiffQuery' => 'PhabricatorCursorPagedPolicyAwareQuery',
     'DifferentialDiffTableOfContentsView' => 'AphrontView',
     'DifferentialDiffTestCase' => 'ArcanistPhutilTestCase',
     'DifferentialDiffViewController' => 'DifferentialController',
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_createrevision_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_createrevision_Method.php
index 9ce3ed90d4..d6b47b58bf 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_createrevision_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_createrevision_Method.php
@@ -33,7 +33,10 @@ final class ConduitAPI_differential_createrevision_Method
   protected function execute(ConduitAPIRequest $request) {
     $fields = $request->getValue('fields');
 
-    $diff = id(new DifferentialDiff())->load($request->getValue('diffid'));
+    $diff = id(new DifferentialDiffQuery())
+      ->setViewer($request->getUser())
+      ->withIDs(array($request->getValue('diffid')))
+      ->executeOne();
     if (!$diff) {
       throw new ConduitException('ERR_BAD_DIFF');
     }
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_finishpostponedlinters_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_finishpostponedlinters_Method.php
index 47b3261808..f3babde6df 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_finishpostponedlinters_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_finishpostponedlinters_Method.php
@@ -35,7 +35,10 @@ final class ConduitAPI_differential_finishpostponedlinters_Method
     $diff_id = $request->getValue('diffID');
     $linter_map = $request->getValue('linters');
 
-    $diff = id(new DifferentialDiff())->load($diff_id);
+    $diff = id(new DifferentialDiffQuery())
+      ->setViewer($request->getUser())
+      ->withIDs(array($diff_id))
+      ->executeOne();
     if (!$diff) {
       throw new ConduitException('ERR-BAD-DIFF');
     }
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_getalldiffs_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_getalldiffs_Method.php
index 117a30d270..4b06a80e87 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_getalldiffs_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_getalldiffs_Method.php
@@ -32,9 +32,10 @@ final class ConduitAPI_differential_getalldiffs_Method
       return $results;
     }
 
-    $diffs = id(new DifferentialDiff())->loadAllWhere(
-      'revisionID IN (%Ld)',
-      $revision_ids);
+    $diffs = id(new DifferentialDiffQuery())
+      ->setViewer($request->getUser())
+      ->withRevisionIDs($revision_ids)
+      ->execute();
 
     foreach ($diffs as $diff) {
       $results[] = array(
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_getcommitpaths_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_getcommitpaths_Method.php
index 2cae4c63a0..56e5120ca1 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_getcommitpaths_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_getcommitpaths_Method.php
@@ -30,7 +30,10 @@ final class ConduitAPI_differential_getcommitpaths_Method
   protected function execute(ConduitAPIRequest $request) {
     $id = $request->getValue('revision_id');
 
-    $revision = id(new DifferentialRevision())->load($id);
+    $revision = id(new DifferentialRevisionQuery())
+      ->setViewer($request->getUser())
+      ->withIDs(array($id))
+      ->executeOne();
     if (!$revision) {
       throw new ConduitException('ERR_NOT_FOUND');
     }
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_getdiff_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_getdiff_Method.php
index 55872bec32..6067e5ae70 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_getdiff_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_getdiff_Method.php
@@ -46,7 +46,10 @@ final class ConduitAPI_differential_getdiff_Method extends ConduitAPIMethod {
     } else {
       $diff_id = $request->getValue('diff_id');
       if ($diff_id) {
-        $diff = id(new DifferentialDiff())->load($diff_id);
+        $diff = id(new DifferentialDiffQuery())
+          ->setViewer($request->getUser())
+          ->withIDs(array($diff_id))
+          ->executeOne();
       }
     }
 
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_updaterevision_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_updaterevision_Method.php
index 532c56c384..d7907194b6 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_updaterevision_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_updaterevision_Method.php
@@ -33,12 +33,18 @@ final class ConduitAPI_differential_updaterevision_Method
   }
 
   protected function execute(ConduitAPIRequest $request) {
-    $diff = id(new DifferentialDiff())->load($request->getValue('diffid'));
+    $diff = id(new DifferentialDiffQuery())
+      ->setViewer($request->getUser())
+      ->withIDs(array($request->getValue('diffid')))
+      ->executeOne();
     if (!$diff) {
       throw new ConduitException('ERR_BAD_DIFF');
     }
 
-    $revision = id(new DifferentialRevision())->load($request->getValue('id'));
+    $revision = id(new DifferentialRevisionQuery())
+      ->setViewer($request->getUser())
+      ->withIDs(array($request->getValue('id')))
+      ->executeOne();
     if (!$revision) {
       throw new ConduitException('ERR_BAD_REVISION');
     }
diff --git a/src/applications/differential/conduit/ConduitAPI_differential_updateunitresults_Method.php b/src/applications/differential/conduit/ConduitAPI_differential_updateunitresults_Method.php
index 6b7b3ee869..b4463a86bf 100644
--- a/src/applications/differential/conduit/ConduitAPI_differential_updateunitresults_Method.php
+++ b/src/applications/differential/conduit/ConduitAPI_differential_updateunitresults_Method.php
@@ -56,7 +56,11 @@ final class ConduitAPI_differential_updateunitresults_Method
       throw new ConduitException('ERR_NO_RESULTS');
     }
 
-    $diff = id(new DifferentialDiff())->load($diff_id);
+    $diff = id(new DifferentialDiffQuery())
+      ->setViewer($request->getUser())
+      ->withIDs(array($diff_id))
+      ->executeOne();
+
     $unit_results = $diff_property->getData();
     $postponed_count = 0;
     $unit_status = null;
diff --git a/src/applications/differential/controller/DifferentialDiffViewController.php b/src/applications/differential/controller/DifferentialDiffViewController.php
index b97bbb92aa..881a3e2026 100644
--- a/src/applications/differential/controller/DifferentialDiffViewController.php
+++ b/src/applications/differential/controller/DifferentialDiffViewController.php
@@ -12,7 +12,10 @@ final class DifferentialDiffViewController extends DifferentialController {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
-    $diff = id(new DifferentialDiff())->load($this->id);
+    $diff = id(new DifferentialDiffQuery())
+      ->setViewer($viewer)
+      ->withIDs(array($this->id))
+      ->executeOne();
     if (!$diff) {
       return new Aphront404Response();
     }
diff --git a/src/applications/differential/controller/DifferentialRevisionEditController.php b/src/applications/differential/controller/DifferentialRevisionEditController.php
index f2234f866e..f7077b750f 100644
--- a/src/applications/differential/controller/DifferentialRevisionEditController.php
+++ b/src/applications/differential/controller/DifferentialRevisionEditController.php
@@ -9,15 +9,18 @@ final class DifferentialRevisionEditController extends DifferentialController {
   }
 
   public function processRequest() {
-
     $request = $this->getRequest();
+    $viewer = $request->getUser();
 
     if (!$this->id) {
       $this->id = $request->getInt('revisionID');
     }
 
     if ($this->id) {
-      $revision = id(new DifferentialRevision())->load($this->id);
+      $revision = id(new DifferentialRevisionQuery())
+        ->setViewer($viewer)
+        ->withIDs(array($this->id))
+        ->executeOne();
       if (!$revision) {
         return new Aphront404Response();
       }
@@ -30,7 +33,10 @@ final class DifferentialRevisionEditController extends DifferentialController {
 
     $diff_id = $request->getInt('diffID');
     if ($diff_id) {
-      $diff = id(new DifferentialDiff())->load($diff_id);
+      $diff = id(new DifferentialDiffQuery())
+        ->setViewer($viewer)
+        ->withIDs(array($diff_id))
+        ->executeOne();
       if (!$diff) {
         return new Aphront404Response();
       }
diff --git a/src/applications/differential/query/DifferentialDiffQuery.php b/src/applications/differential/query/DifferentialDiffQuery.php
new file mode 100644
index 0000000000..e7ee463a2e
--- /dev/null
+++ b/src/applications/differential/query/DifferentialDiffQuery.php
@@ -0,0 +1,55 @@
+<?php
+
+final class DifferentialDiffQuery
+  extends PhabricatorCursorPagedPolicyAwareQuery {
+
+  private $ids;
+  private $revisionIDs;
+
+  public function withIDs(array $ids) {
+    $this->ids = $ids;
+    return $this;
+  }
+
+  public function withRevisionIDs(array $revision_ids) {
+    $this->revisionIDs = $revision_ids;
+    return $this;
+  }
+
+  public function loadPage() {
+    $table = new DifferentialDiff();
+    $conn_r = $table->establishConnection('r');
+
+    $data = queryfx_all(
+      $conn_r,
+      'SELECT * FROM %T %Q %Q %Q',
+      $table->getTableName(),
+      $this->buildWhereClause($conn_r),
+      $this->buildOrderClause($conn_r),
+      $this->buildLimitClause($conn_r));
+
+    return $table->loadAllFromArray($data);
+  }
+
+  private function buildWhereClause(AphrontDatabaseConnection $conn_r) {
+    $where = array();
+
+    if ($this->ids) {
+      $where[] = qsprintf(
+        $conn_r,
+        'id IN (%Ld)',
+        $this->ids);
+    }
+
+    if ($this->revisionIDs) {
+      $where[] = qsprintf(
+        $conn_r,
+        'revisionID IN (%Ld)',
+        $this->revisionIDs);
+    }
+
+    $where[] = $this->buildPagingClause($conn_r);
+    return $this->formatWhereClause($where);
+  }
+
+}
diff --git a/src/applications/differential/query/DifferentialRevisionQuery.php b/src/applications/differential/query/DifferentialRevisionQuery.php
index e889cfd148..2dce0eba79 100644
--- a/src/applications/differential/query/DifferentialRevisionQuery.php
+++ b/src/applications/differential/query/DifferentialRevisionQuery.php
@@ -413,6 +413,10 @@ final class DifferentialRevisionQuery {
     return $revisions;
   }
 
+  public function executeOne() {
+    return head($this->execute());
+  }
+
 
   /**
    * Determine if we should execute an optimized, fast-path query to fetch
diff --git a/src/applications/differential/storage/DifferentialDiff.php b/src/applications/differential/storage/DifferentialDiff.php
index b53455ade3..b64fc8ca46 100644
--- a/src/applications/differential/storage/DifferentialDiff.php
+++ b/src/applications/differential/storage/DifferentialDiff.php
@@ -1,6 +1,8 @@
 <?php
 
-final class DifferentialDiff extends DifferentialDAO {
+final class DifferentialDiff
+  extends DifferentialDAO
+  implements PhabricatorPolicyInterface {
 
   protected $revisionID;
   protected $authorPHID;
@@ -258,4 +260,22 @@ final class DifferentialDiff extends DifferentialDAO {
     return $dict;
   }
 
+
+/* -(  PhabricatorPolicyInterface  )----------------------------------------- */
+
+
+  public function getCapabilities() {
+    return array(
+      PhabricatorPolicyCapability::CAN_VIEW,
+    );
+  }
+
+  public function getPolicy($capability) {
+    return PhabricatorPolicies::POLICY_USER;
+  }
+
+  public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
+    return false;
+  }
+
 }