anchor.diff:  Collaborators in an org share a resource quota plan, applications, services
   availability, and custom domains.
   
  -### <a id='users'></a>User Accounts ##
  +## <a id='users'></a>User Accounts ##
   
   A user account represents an individual person within the context of a Cloud
   Foundry installation.
   A user can have different roles in different spaces within an org, governing
   what level and type of access they have within that space.
   
  -### <a id='spaces'></a>Spaces ##
  +## <a id='spaces'></a>Spaces ##
   
   Every application and service is scoped to a space.
   Each org contains at least one space.
  
positive.code: development, deployment, and maintenance.
  Each space role applies only to a particular space.
  
  ### <a id='roles'></a>Roles and Permissions ##
  
  A user can have one or more roles.
  The combination of these roles defines the user’s overall permissions in the
  org and within specific spaces in that org.
  
  * **Org Managers** are managers or other users who need to administer the account and must be assigned from the UAA CLI. See the <a href="../adminguide/uaa-user-management.html">Creating and Managing Users with the UAA CLI (UAAC)</a> topic to learn how to create a user with admin rights.
  
  
negative.code: ---
  title: Orgs, Spaces, Roles, and Permissions
  owners: CAPI, Identity
  ---
  
  <strong><%= modified_date %></strong>
  
  <%= vars.product_name %> uses role-based access control, with each role granting permissions in either an org or a space.
  
  ## <a id='orgs'></a>Orgs ##
  
  An org is a development account that an individual or multiple collaborators
  can own and use.
  