anchor.diff:         {desc, <<"Can manage ALL bucket features for specified buckets (incl. start/stop XDCR)">>}],
         [{[{bucket, bucket_name}, xdcr], [read, execute]},
          {[{bucket, bucket_name}], all},
  -       {[{bucket, all}, data], none},
  -       {[{bucket, all}, settings], [read]},
  +       {[{bucket, any}, data], none},
  +       {[{bucket, any}, settings], [read]},
          {[admin], none},
          {[], [read]}]},
        {bucket_sasl, [bucket_name],
  
positive.code: substitute_params(Params, ParamDefinitions, Permissions) ->
      ParamPairs = lists:zip(ParamDefinitions, Params),
      lists:map(fun ({ObjectPattern, AllowedOperations}) ->
                        {lists:map(fun ({Name, all}) ->
                                           {Name, all};
                                       ({Name, Param}) ->
                                           {Param, Subst} = lists:keyfind(Param, 1, ParamPairs),
                                           {Name, Subst};
  
negative.code:      {ro_admin, [],
        [{name, <<"Read Only Admin">>},
         {desc, <<"Can view ALL cluster features.">>}],
        [{[{bucket, any}, password], none},
         {[{bucket, any}, data], none},
         {[admin, security], [read]},
         {[admin], none},
         {[], [read]}]},
  