anchor.diff:  
   ## <a id='unbinding-groups'></a>Unbinding Application Security Groups ##
   
  -<p class='note'><strong>Note</strong>: Unbinding an ASG will not affect started applications until they are restarted.</p>
  -
  -To unbind an ASG from the `default-staging` set:
  +<p class='note'><strong>Note</strong>: Unbinding an ASG does not affect started applications until you restart them.</p>
  +
  +To unbind an ASG from the `default-staging` set, run the following command:
   
   <pre class="terminal">
   $ cf unbind-staging-security-group SECURITY-GROUP
   </pre>
   
  -To unbind an ASG from the `default-running` set:
  +To unbind an ASG from the `default-running` set, run the following command:
   
   <pre class="terminal">
   $ cf unbind-running-security-group SECURITY-GROUP
   </pre>
   
  -To unbind an ASG from a specific space:
  +To unbind an ASG from a specific space, run the following command:
   
   <pre class="terminal">
   $ cf unbind-security-group SECURITY-GROUP ORG SPACE
  
positive.code: The `default-running` ASG set applies to application containers that are
  started and running applications.
  
  In addition to the `default-staging` and `default-running` ASG sets, <%= vars.product_full %>
  administrators may configure additional ASGs which may be bound to <%= vars.product_full %>
  [spaces](../concepts/roles.html#spaces). ASGs bound to spaces add network
  access only to the application containers within that space.
  
  When an application container is created the egress rules for that application
  container is the union of:
  
  * All ASGs in either the `default-staging` or `default-running` set
  * All ASGs bound to the space of the application
  
negative.code: 
  ## <a id='updating-groups'></a>Updating Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them.</p>
  
  To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  <pre class="terminal">
  