anchor.diff:  * Change the number of instances, memory allocation, and disk limit of each application in the space
   * Associate an internal or external URL with an application
   
  -####Space Auditor ####
  +#####Space Auditor ####
   
   Assign this role to people who need to view but not edit the space.
   
   A Space Auditor can do the following:
   
  -* View the status, number of instances, service bindings, and resource use of each application in the space+* View the status, number of instances, service bindings, and resource use of each application in the space
  +
  +##<a id="end-user"></a>End User
  +
  +People with permissions to use specific applications hosted by ER; they don't directly interact with any ER components
  +
  +* Without SSO: end users are up to individual application developers. Who can use what app is governed by each application, defined separately
  +
  +* [PCF,PWS: With SSO - centralized end user management supports SSO for multiple apps (easier!)
  +
  +####<a id=""></a>Ops Man Admin installs SSO Tile, runs SSO Dashboard, creates service plan that registers various applications, presents dashboard via Okta, etc.
  +
  +####<a id=""></a>Space Manager create instance of service plan and associates End Users via either internal or external store
  +
  +* External: SAML or LDAP, which can be different from external user store used for ER Users, above
  +
  +* Internal UAA: Space Manager associates existing users to plans via SSO dashboard or cf CLI, and create new users via cf CLI ]
  +
  +
  +
  
positive.code: 
  <%= vars.link_adminguide_commands %>
  
  ####Org Auditor ####
  
  Assign this role to people who need to view but not edit user information and
  org quota usage information.
  
negative.code: development, deployment, and maintenance.
  Each space role applies only to a particular space.
  
  ### <a id='roles'></a>Roles and Permissions ##
  
  A user can have one or more roles.
  The combination of these roles defines the user’s overall permissions in the
  org and within specific spaces in that org.
  
  #### <a id='org-roles'></a>Org Roles and Permissions ###
  
  #####Org Manager ####
  
  Assign this role to managers or other users who need to administer the account.
  
  