anchor.diff:  $ cf unbind-security-group SECURITY-GROUP ORG SPACE
   </pre>
   
  -### <a id='deleting-groups'></a>Delete ASGs 
  -
  -<p class='note'><strong>Note</strong>: You can only delete unbound ASGs. 
  -To unbind ASGs, see the <a href="#unbinding-groups">Unbinding ASGs</a> section of this topic.</p>
  +## <a id='deleting-groups'></a>Deleting ASGs ##
  +
  +<p class='note'><strong>Note</strong>: You can only delete unbound ASGs. To unbind ASGs, see the <a href="#unbinding-groups">Unbinding ASGs</a> section of this topic.</p>
   
   To delete an ASG, run the following command:
   
  
positive.code: 
  ### <a id='public-networks-example'></a>Public Networks ###
  
  Apps often require public network connectivity to retrieve app dependencies 
  or to integrate with services available on public networks. 
  Example app dependencies include public Maven repositories, NPM, RubyGems, and Docker registries.
  
  <p class='note'><strong>Note</strong>: You should exclude IaaS metadata endpoints, such as <code>169.254.169.254</code>, 
  because the metadata endpoint can expose sensitive environment information to untrusted apps. 
  The <code>public_networks</code> example below accounts for this recommendation.</p>
  
  Example `public_networks` ASG:
  
  
negative.code: <%= partial '../opsguide/default_asg' %>
  <% end %>
  
  ## <a id="asg-sets"></a> ASG Sets ##
  
  An ASG set is a collection of ASGs that an administrator can apply to application containers. 
  
  ### <a id="default-set"></a> Default ASG Sets ###
  
  All application containers in <%= vars.product_full %> use a default ASG set as a base policy.
  
  <%= vars.product_full %> provides two default ASG sets:
  
  * `default-staging`: This ASG set applies to application containers that are in the
  staging application lifecycle phase. This includes both the buildpack staging
  and Docker staging process. Typically, ASGs applied to staging application containers are more permissive to allow access to resources required for build and staging processes.
  * `default-running`: This ASG set applies to application containers that are
  started and running apps or tasks. Typically, ASGs applied to containers running apps and tasks are more restrictive.
  
  ### <a id="space-scoped"></a> Space-Scoped ASG Sets ###
  
  In addition to the `default-staging` and `default-running` ASG sets, administrators can define additional ASGs and bind them to <%= vars.product_full %> [spaces](../concepts/roles.html#spaces). These ASGs are scoped to the space and are applied as a set to all application containers, either running or staging, in that space.
  
  ASGs bound to spaces add network access only to the application containers within that space. 
  
  In addition, space-scoped ASGs also apply to either staging tasks or running tasks.
  
  Currently, <%= vars.product_full %> supports the use of space-scoped ASGs for staging application containers, however this is only supported via the CC API and not yet supported by the cf CLI. 
  
  To apply staging-level network access to space-scoped ASGs, use the following CloudController (CC) API commands:
  
  <pre>
  GET /v2/security_groups/:guid/staging_spaces
  PUT /v2/spaces/:guid/staging_security_groups/:security_group_guid data
  PUT /v2/security_groups/:guid/staging_spaces/:space_guid
  DELETE /v2/spaces/:guid/staging_security_groups/:security_group_guid  data
  DELETE /v2/security_groups/:guid/staging_spaces/:space_guid
  </pre>
  
  These API calls require administrator access. 
  
  Additionally, the payload returned from API `GET` calls to
  `/v2/spaces/` and `/v2/spaces/:guid` includes a link to the 
  `staging_security_groups_url`.
  
  For more information on using these CC API commands, see the [Cloud Foundry API](https://apidocs.cloudfoundry.org/) documentation.
  
  ### <a id="asg-sets-applied"></a>How ASG Sets Are Applied ###
  
  When <%= vars.product_full %> creates an application container, the egress rules for the application container include the following:
  
  * All ASGs in either the `default-staging` or `default-running` set, depending on the staging or running state of LRP or task
  * All ASGs bound to the space associated with the LRP or task, depending on the staging or running state of the LRP or task
  
  ## <a id='viewing'></a>Viewing ASGs ##
  
  Run the following commands to view information about existing ASGs:
  
  |Command                             |Output
  |---                                 |---
  |`cf security-groups`                |All security groups
  |`cf staging-security-groups`        |All security groups in the `default-staging` set
  |`cf running-security-groups`        |All security groups in the `default-running` set
  |`cf security-group SG-NAME`         |All rules in the security group specified by `SG-NAME`
  
  ## <a id='creating-groups'></a>Creating ASGs ##
  
  <p class='note'><strong>Note</strong>: After creating an ASG, you must bind it for it to take effect. See the <a href="#binding-groups">Binding ASGs</a> section of this topic for more information.</p>
  
  ASG rules are specified as a JSON array of ASG objects. An ASG object has the following attributes:
  
  