anchor.diff:  The `default-running` ASG set applies to application containers that are
   started and running applications.
   
  -In addition to the `default-staging` and `default-running` ASG sets, <%= vars.product_full %>
  -administrators may configure additional ASGs which may be bound to <%= vars.product_full %>
  +In addition to the `default-staging` and `default-running` ASG sets, administrators can configure additional ASGs and bind them to <%= vars.product_full %>
   [spaces](../concepts/roles.html#spaces). ASGs bound to spaces add network
   access only to the application containers within that space.
   
  -When an application container is created the egress rules for that application
  -container is the union of:
  +When <%= vars.product_full %> creates an application container, the egress rules for the application
  +container include the following:
   
   * All ASGs in either the `default-staging` or `default-running` set
   * All ASGs bound to the space of the application
  
positive.code: 
  ## <a id='updating-groups'></a>Updating Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: Updating an ASG will not affect started applications until they are restarted.</p>
  
  To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  <pre class="terminal">
  
negative.code: 
  ### <a id='public-networks-example'></a>Public Networks ###
  
  Applications often require public network connectivity to retrieve application dependencies or to integrate with services available on public networks. Example application dependencies include public Maven repositories, NPM, RubyGems, Docker registries and others.
  
  <p class='note'><strong>Note</strong>: Exclude IaaS metadata endpoints, such as 169.254.169.254, because the metadata endpoint can expose sensitive environment information to untrusted applications. The <code>public_networks</code> example below accounts for this recommendation.</p>
  
  Example `public_networks` ASG:
  
  