anchor.diff:  %%%===================================================================
   
   %%--------------------------------------------------------------------
  +%% @doc Returns privileges from list. It is required so that privileges are
  +%% always sorted.
  +%% @end
  +%%--------------------------------------------------------------------
  +-spec from_list(PrivilegesList) -> privileges(atom()).
  +from_list(PrivilegesList) ->
  +    ordsets:from_list(PrivilegesList).
  +
  +
  +%%--------------------------------------------------------------------
  +%% @doc Returns privileges from list. It is required so that privileges are
  +%% always sorted.
  +%% @end
  +%%--------------------------------------------------------------------
  +-spec union(PrivilegesA, PrivilegesB) -> privileges(atom()).
  +union(PrivilegesA, PrivilegesB) ->
  +    ordsets:union(from_list(PrivilegesA), from_list(PrivilegesB)).
  +
  +
  +%%--------------------------------------------------------------------
  +%% @doc Returns privileges from list. It is required so that privileges are
  +%% always sorted.
  +%% @end
  +%%--------------------------------------------------------------------
  +-spec union(PrivilegesA, PrivilegesB) -> privileges(atom()).
  +subtract(PrivilegesA, PrivilegesB) ->
  +    ordsets:subtract(from_list(PrivilegesA), from_list(PrivilegesB)).
  +
  +
  +%%--------------------------------------------------------------------
   %% @doc A privilege level of a Space user.
   %%--------------------------------------------------------------------
  --spec space_user() -> [space_privilege()].
  +-spec space_user() -> privileges(space_privilege()).
   space_user() ->
  -    ordsets:from_list([space_view_data, space_write_files]).
  +    from_list([space_view_data, space_write_files]).
   
   %%--------------------------------------------------------------------
   %% @doc A privilege level of a Space manager.
   %%--------------------------------------------------------------------
  --spec space_manager() -> [space_privilege()].
  +-spec space_manager() -> privileges(space_privilege()).
   space_manager() ->
  -    ordsets:union(
  -        space_user(),
  -        ordsets:from_list([
  -            space_invite_user,
  -            space_remove_user,
  -            space_invite_group,
  -            space_remove_group,
  -            space_manage_shares
  -        ])
  -    ).
  +    union(space_user(), [
  +        space_invite_user,
  +        space_remove_user,
  +        space_invite_group,
  +        space_remove_group,
  +        space_manage_shares
  +    ]).
   
   %%--------------------------------------------------------------------
   %% @doc A privilege level of a Space administrator. This level contains all
   %% atoms representing space privileges.
   %% @end
   %%--------------------------------------------------------------------
  --spec space_admin() -> [space_privilege()].
  +-spec space_admin() -> privileges(space_privilege()).
   space_admin() ->
  -    ordsets:union(
  -        space_manager(),
  -        ordsets:from_list([
  -            space_add_provider,
  -            space_remove_provider,
  -            space_set_privileges,
  -            space_change_data,
  -            space_remove
  -        ])
  -    ).
  +    union(space_manager(), [
  +        space_add_provider,
  +        space_remove_provider,
  +        space_set_privileges,
  +        space_change_data,
  +        space_remove
  +    ]).
   
   %%--------------------------------------------------------------------
   %% @doc All atoms representing space privileges.
   %% @equiv space_admin()
   %%--------------------------------------------------------------------
  --spec space_privileges() -> [space_privilege()].
  +-spec space_privileges() -> privileges(space_privilege()).
   space_privileges() ->
       space_admin().
   
  
positive.code: %%--------------------------------------------------------------------
  %% @doc A privilege level of a handle_service user.
  %%--------------------------------------------------------------------
  -spec handle_service_user() -> [handle_service_privilege()].
  handle_service_user() ->
      ordsets:from_list([view_handle_service, register_handle]).
  
  %%--------------------------------------------------------------------
  %% @doc A privilege level of a handle_service administrator. This level contains all
  %% atoms representing handle_service privileges.
  %% @end
  %%--------------------------------------------------------------------
  -spec handle_service_admin() -> [handle_service_privilege()].
  handle_service_admin() ->
      ordsets:union(
          handle_service_user(),
          ordsets:from_list([
  %%            register_handle_service, % we may need those privileges for admins in oz_privileges
  %%            list_handle_services,
              delete_handle_service,
              modify_handle_service,
              view_handle_service
          ])
      ).
  
  %%--------------------------------------------------------------------
  %% @doc All atoms representing handle_service privileges.
  %% @equiv handle_service_admin()
  %%--------------------------------------------------------------------
  -spec handle_service_privileges() -> [handle_service_privilege()].
  handle_service_privileges() ->
      handle_service_admin().
  
  
negative.code: %%--------------------------------------------------------------------
  %% @doc A privilege level of a group user.
  %%--------------------------------------------------------------------
  -spec group_user() -> privileges(group_privilege()).
  group_user() ->
      from_list([group_view_data]).
  
  %%--------------------------------------------------------------------
  %% @doc A privilege level of a group manager.
  %%--------------------------------------------------------------------
  -spec group_manager() -> privileges(group_privilege()).
  group_manager() ->
      union(group_user(), [
          group_invite_user,
          group_remove_user,
          group_invite_group,
          group_remove_group
      ]).
  
  %%--------------------------------------------------------------------
  %% @doc A privilege level of a group administrator. This level contains all
  %% atoms representing group privileges.
  %% @end
  %%--------------------------------------------------------------------
  -spec group_admin() -> privileges(group_privilege()).
  group_admin() ->
      union(group_manager(), [
          group_create_space,
          group_create_space_token,
          group_join_space,
          group_leave_space,
          group_set_privileges,
          group_change_data,
          group_remove,
          group_join_group
      ]).
  
  %%--------------------------------------------------------------------
  %% @doc All atoms representing group privileges.
  %% @equiv group_admin()
  %%--------------------------------------------------------------------
  -spec group_privileges() -> privileges(group_privilege()).
  group_privileges() ->
      group_admin().
  
  