anchor.diff:      </tr>
       <tr>
         <td nowrap><code>zones.ZONE-ID.admin</code></td>
  -      <td>This scope permits operations in a designated zone by authenticating against the default zone, such as create identity providers or clients in another zone. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
  +      <td>This scope permits operations in a designated zone, such as creating identity providers or clients in another zone, by authenticating against the default zone. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
       </tr>
       <tr>
         <td nowrap><code>zones.ZONE-ID.read</code></td>
  
positive.code:   </tr>
    <tr>
      <td><code>scim.zones</code></td>
      <td>This is a limited scope only allows adding a user to or removing a user from zone management groups under the path <code>/Groups/zones</code>.</td>
      <tr>
        <td><code>oauth.approval</code></td> 
        <td><code>/approvals endpoint</code>. This scope is required to be able to approve or reject clients in order to act on a user's behalf. This is a default scope defined in uaa.yml.</td>
      </tr>
      <tr>
        <td><code>oauth.login</code></td>
        <td>This scope is used to indicate a login application, such as external login servers, to perform trusted operations, such as create users not authenticated in the UAA.</td>
      </tr>
      <tr>
        <td><code>approvals.me</code></td>
  
negative.code:     </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.admin</code></td>
        <td>This scope translates into <code>clients.admin</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>  
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.read</code></td>
        <td>This scope translates into <code>clients.read</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.write</code></td>
        <td>This scope translates into <code>clients.write</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.scim.read</code></td>
        <td>This scope translates into <code>scim.read</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.scim.create</code></td>
        <td>This scope translates into <code>scim.create</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.scim.write</code></td>
        <td>This scope translates into <code>scim.write</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.idps.read</code></td>
        <td>This scope translates into <code>idps.read</code> after zone switch completes. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
    </tr> 
  </table>
  