anchor.diff:  
   The same person can act as both of these administrators.
   
  -###<a id="ops-man-admin"></a>Ops Manager Administrator
  +### <a id="ops-man-admin"></a>Ops Manager Administrator
   
   An Ops Manager Admin creates a PCF deployment by deploying Ops Manager onto an infrastructure. When Ops Man boots for the first time, the Ops Man Admin specifies that the deployment draws its user account information from one of two places:
   
   1. An internal UAA database that Ops Manager creates new for the deployment.
   1. An external, existing identity provider accessed via SAML or LDAP protocol
   
  -The Ops Manager Admin uses the cf CLI to create [additional Ops Manager Admin](../customizing/opsman-users.html) accounts.
  +The Ops Manager Admin uses the UAACß to create [additional Ops Manager Admin](../customizing/opsman-users.html) accounts.
   
   Ops Manager Admins create, operate, and add capabilities to deployments through the Ops Manager Installation Dashboard by installing and configuring tiles for Elastic Runtime and other products and services.
   
  -###<a id="er-admin"></a>Elastic Runtime Administrator
  +### <a id="er-admin"></a>Elastic Runtime Administrator
   
   The Elastic Runtime Admin deploys and configures the Elastic Runtime tile, plus product and service tiles that the PCF deployment uses.
   
  -The Elastic Runtime Admin configures the Elastic Runtime tile to specify whether the deployment's user account information comes from an internal UAA or from an external identity provider. They can then add user accounts and define Organizations and Spaces within the deployment. These virtual compartments allow [Elastic Runtime users](#er-user) to self-administer user accounts, roles, and permissions within semi-autonomous subsections of the deployment.
  +The Elastic Runtime Admin configures the Elastic Runtime tile to specify whether the deployment's user account information comes from an internal UAA or from an external identity provider.
  +
  +The Elastic Runtime Admin adds user accounts and define Organizations and Spaces within the deployment. These virtual compartments allow [Elastic Runtime users](#er-user) to self-administer user accounts, roles, and permissions within semi-autonomous subsections of the deployment.
   
   <p class="note"><strong>Note</strong>: The internal UAA for Elastic Runtime is the system-wide UAA for storing user information. It differs from the Ops Manager internal UAA, which only stores Ops Manager Admin accounts.</p>
   
  -##<a id="er-user"></a>Elastic Runtime User
  -
  -The Elastic Runtime user 
  +## <a id="er-user"></a>Elastic Runtime User
  +
  +Elastic Runtime users include application developers, managers, and auditors who work within Organizations and Spaces. The Elastic Runtime admin manages ER users.
  +
  +Cloud Foundry uses role-based access control (RBAC), with each role granting permissions in either an org or a space.
  +
  +ER user records are kept in the Elastic Runtime user store, which can be internal or external. User roles are kept in the Cloud Controller DB, not the ER user store.
   	
  -ER Admin defines ER user records in internal ER UAA or external User Store
  -	
  -you can mainly think of ER Users as developers, but also managers and auditors - see roles below
   
   User roles:
  +
   * associate users with, well, roles (or permissions) in orgs and spaces
   
   * defined by ER Admin in CC DB
  
positive.code: 
  * [PCF,PWS: With SSO - centralized end user management supports SSO for multiple apps (easier!)
  
  ####<a id=""></a>Ops Man Admin installs SSO Tile, runs SSO Dashboard, creates service plan that registers various applications, presents dashboard via Okta, etc.
  
  ####<a id=""></a>Space Manager create instance of service plan and associates End Users via either internal or external store
  
  * External: SAML or LDAP, which can be different from external user store used for ER Users, above
  
  * Internal UAA: Space Manager associates existing users to plans via SSO dashboard or cf CLI, and create new users via cf CLI ]
  
  
  
  
negative.code: 			Space Dev
  			Space Auditor
  
  
  
  ### <a id='orgs-spaces-roles'></a>Orgs, Spaces, Roles, and Permissions ##
  
  For developers and other <%= vars._product_name %> users, a role-based access control system grants permissions in either an org or a space.
  
  