anchor.diff:  | list durable-cqs                       | CLUSTER:READ                     |
   | list functions                         | CLUSTER:READ                     |
   | list gateways                          | CLUSTER:READ                     |
  -| list indexes                           | CLUSTER:READ                     |
  -| list lucene indexes                    | CLUSTER:READ                     |
  +| list indexes                           | CLUSTER:READ:QUERY               |
  +| list lucene indexes                    | CLUSTER:READ:LUCENE              |
   | list members                           | CLUSTER:READ                     |
   | list regions                           | CLUSTER:READ                     |
  -| load-balance gateway-sender            | DATA:MANAGE                      |
  +| load-balance gateway-sender            | CLUSTER:MANAGE:GATEWAY           |
   | locate entry                           | DATA:READ:RegionName:Key         |
   | netstat                                | CLUSTER:READ                     |
  -| pause gateway-sender                   | DATA:MANAGE                      |
  -| pdx rename                             | DATA:MANAGE                      |
  +| pause gateway-sender                   | CLUSTER:MANAGE:GATEWAY           |
   | put --key=key1 --region=region1        | DATA:WRITE:RegionName:Key        |
  -| query                                  | DATA:READ                        |
  +| query                                  | DATA:READ                        
   | rebalance                              | DATA:MANAGE                      |
   | remove                                 | DATA:WRITE:RegionName or DATA:WRITE:RegionName:Key |
  -| resume gateway-sender                  | DATA:MANAGE                      |
  -| revoke mising-disk-store               | DATA:MANAGE                      |
  -| search lucene                          | DATA:WRITE                       |
  +| resume gateway-sender                  | CLUSTER:MANAGE:GATEWAY           |
  +| revoke mising-disk-store               | CLUSTER:MANAGE:DISK              |
  +| search lucene                          | DATA:READ:RegionName             |
   | show dead-locks                        | CLUSTER:READ                     |
   | show log                               | CLUSTER:READ                     |
   | show metrics                           | CLUSTER:READ                     |
   | show missing-disk-stores               | CLUSTER:READ                     |
   | show subscription-queue-size           | CLUSTER:READ                     |
   | shutdown                               | CLUSTER:MANAGE                   |
  -| start gateway-receiver                 | DATA:MANAGE                      |
  -| start gateway-sender                   | DATA:MANAGE                      |
  +| start gateway-receiver                 | CLUSTER:MANAGE:GATEWAY           |
  +| start gateway-sender                   | CLUSTER:MANAGE:GATEWAY           |
   | start server                           | CLUSTER:MANAGE                   |
   | status cluster-config-service          | CLUSTER:READ                     |
   | status gateway-receiver                | CLUSTER:READ                     |
   | status gateway-sender                  | CLUSTER:READ                     |
   | status locator                         | CLUSTER:READ                     |
   | status server                          | CLUSTER:READ                     |
  -| stop gateway-receiver                  | DATA:MANAGE                      |
  -| stop gateway-receiver                  | DATA:MANAGE                      |
  +| stop gateway-receiver                  | CLUSTER:MANAGE:GATEWAY           |
  +| stop gateway-receiver                  | CLUSTER:MANAGE:GATEWAY           |
   | stop locator                           | CLUSTER:MANAGE                   |
   | stop server                            | CLUSTER:MANAGE                   |
  -| undeploy                               | DATA:MANAGE                      |
  +| undeploy                               | CLUSTER:MANAGE:JAR               |
   
   The `gfsh connect` does not have a permission,
   as it is the operation that invokes authentication. 
   These `gfsh` commands do not have permission defined,
  -as they do not interact with the distributed system.
  +as they do not interact with the distributed system:
   
   -  `gfsh describe connection`, which describes the `gfsh` end of the connection
   -  `gfsh debug`, which toggles the mode within `gfsh`
  
positive.code: 
  | `gfsh` Command                         | Assigned `ResourcePermission`
  |----------------------------------------|----------------------------------|
  | alter disk-store                       | DATA:MANAGE                      |
  | alter region                           | DATA:MANAGE:RegionName           |
  | alter runtime                          | CLUSTER:MANAGE                   |
  | backup disk-store                      | DATA:READ                        |
  | change loglevel                        | CLUSTER:WRITE                    |
  | clear defined indexes                  | DATA:MANAGE                      |
  | close durable-client                   | DATA:MANAGE                      |
  | close durable-cq                       | DATA:MANAGE                      |
  | compact disk-store                     | DATA:MANAGE                      |
  | compact offline-disk-store             | DATA:MANAGE                      |
  | configure pdx                          | CLUSTER:MANAGE                   |
  | create async-event-queue               | DATA:MANAGE                      |
  | create defined indexes                 | DATA:MANAGE                      |
  | create disk-store                      | DATA:MANAGE                      |
  | create gateway-receiver                | DATA:MANAGE                      |
  | create gateway-sender                  | DATA:MANAGE                      |
  | create index                           | DATA:MANAGE:RegionName           |
  | create lucene index                    | DATA:MANAGE:RegionName           |
  | create region                          | DATA:MANAGE                      |
  | define index                           | DATA:MANAGE:RegionName           |
  | deploy                                 | DATA:MANAGE, DATA:WRITE, CLUSTER:MANAGE, and CLUSTER:WRITE |
  | describe client                        | CLUSTER:READ                     |
  | describe config                        | CLUSTER:READ                     |
  | describe disk-store                    | CLUSTER:READ                     |
  | describe lucene index                  | CLUSTER:READ                     |
  | describe member                        | CLUSTER:READ                     |
  | describe offline-disk-store            | CLUSTER:READ                     |
  | describe region                        | CLUSTER:READ                     |
  | destroy disk-store                     | DATA:MANAGE                      |
  | destroy function                       | DATA:MANAGE                      |
  | destroy index                          | DATA:MANAGE or DATA:MANAGE:RegionName |
  | destroy lucene index                   | DATA:MANAGE:RegionName           |
  | destroy region                         | DATA:MANAGE                      |
  | disconnect                             | DATA:MANAGE                      |
  | echo                                   | DATA:MANAGE                      |
  | encrypt password                       | DATA:MANAGE                      |
  | execute function                       | DATA:WRITE                       |
  | export cluster-configuration           | CLUSTER:READ                     |
  | export config                          | CLUSTER:READ                     |
  | export data                            | CLUSTER:READ                     |
  
negative.code: | Region.registerInterest(regex)     | DATA:READ:RegionName                |
  | Region.unregisterInterest(key)     | DATA:READ:RegionName:Key            |
  | Region.unregisterInterest(regex)   | DATA:READ:RegionName                |
  | execute function                   | determined by the function API      |
  | clear region                       | DATA:WRITE:RegionName               |
  | Region.putAll                      | DATA:WRITE:RegionName               |
  | Region.clear                       | DATA:WRITE:RegionName               |
  | Region.removeAll                   | DATA:WRITE:RegionName               |
  | Region.destroy(key)                | DATA:WRITE:RegionName:Key           |
  | Region.invalidate(key)             | DATA:WRITE:RegionName:Key           |
  | Region.destroy(key)                | DATA:WRITE:RegionName:Key           |
  | Region.put(key)                    | DATA:WRITE:RegionName:Key           |
  | Region.replace                     | DATA:WRITE:RegionName:Key           |
  
  