anchor.diff:  
   * **Space Auditors**: Read-only access to a space.
   
  -## <a id='roles'></a> Permissions
  +For non-admin users, the `cloud_controller.read` scope is required to view resources, and the `cloud_controller.write` scope is required to create, update, and delete resources.
   
  -Each user role includes different permissions for the user account in a <%= vars.product_name %> foundation. The following sections describe the permissions associated with each user role in both active and suspended orgs in <%= vars.product_name %>.
  +Before you assign a space role to a user, you must assign an org role to the user. The error message `Server error, error code: 1002, message: cannot set space role because user is not part of the org` occurs when you try to set a space role before setting an org role for the user.
  +
  +## <a id='permissions'></a> User Role Permissions
  +
  +Each user role includes different permissions in a <%= vars.product_name %> foundation. The following sections describe the permissions associated with each user role in both active and suspended orgs in <%= vars.product_name %>.
   
   ### <a id='activeroles'></a>Roles and Permissions for Active Orgs
   
  -The following table describes the permissions for various <%= vars.product_name %> roles in active orgs.
  +The following table describes the default permissions for various <%= vars.product_name %> roles in active orgs.
  +
  +<p class="note"><b>Note:</b> You can use feature flags to edit some of the default permissions in the following table. For more information, see <a href="../adminguide/listing-feature-flags.html">Using Feature Flags</a>.
   
   <%= partial vars.roles_table %>
   
  
positive.code: owners: CAPI, Identity
  ---
  
  This topic describes orgs and spaces within a <%= vars.product_name %> foundation. It also describes the default permissions for user roles in <%= vars.product_name %>.
  
  ## <a id="overview"></a> Overview
  
  <%= vars.product_name %> uses a role-based access control (RBAC) system to grant <%=vars.product_full %> users permissions appropriate to their role within an org or a space. 
  
  Admins, Org Managers, and Space Managers can assign user roles using the [cf CLI](../cf-cli/getting-started.html#user-roles)<%= vars.or_apps_man %>.	
  
  
  ## <a id='orgs'></a>Orgs ##
  
negative.code: 
  Roles can be assigned different scopes of User Account and Authentication (UAA) privileges. For more information about UAA scopes, see [Scopes](https://docs.cloudfoundry.org/concepts/architecture/uaa.html#scopes) in _Component: User Account and Authentication (UAA) Server_.
  
  The following describes each type of user role in <%= vars.product_name %>:
  
  <%= vars.admin_role %>
  <%= vars.admin_read_only_role %>
  