anchor.diff:  <table id='oss-roles-permissions' border='1' class='nice'>
  -    <tr>
  -        <th>Activity</th>
  -        <th>Admin</th>
  -        <th>Admin Read-Only</th>
  -        <th>Global Auditor</th>
  -        <th>Org Manager</th>
  -        <th>Org Auditor</th>
  -        <th>Org Billing Manager</th>
  -        <th>Org User</th>
  -        <th>Space Manager</th>
  -        <th>Space Developer</th>
  -        <th>Space Auditor</th>
  - 
  -    </tr><tr>
  -        <td>Scope of operation</td>
  -        <td>Org</td> 
  -        <td>Org</td>
  -        <td>Org</td>
  -        <td>Org</td>
  -        <td>Org</td>
  -        <td>Org</td>
  -        <td>Org</td>
  -        <td>Space</td>
  -        <td>Space</td>
  -        <td>Space</td>
  -    </tr><tr>
  -        <td>Assign user roles</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td> 
  -    </tr><tr>
  -        <td>View users and roles</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -    </tr><tr>
  -        <td>Create and assign org quota plans</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -        <td>View org quota plans</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -    </tr><tr>
  -        <td>Create orgs</td>
  -        <td>Yes</td>
  -        <td><sup><strong></strong></sup></td>
  -        <td><sup><strong></strong></sup></td>
  -        <td><sup><strong>1</strong></sup></td>
  -        <td><sup><strong>1</strong></sup></td>
  -        <td><sup><strong>1</strong></sup></td>
  -        <td><sup><strong>1</strong></sup></td>
  -        <td><sup><strong>1</strong></sup></td>
  -        <td><sup><strong>1</strong></sup></td> 
  -        <td><sup><strong>1</strong></sup></td> 
  -    </tr>
  -    <tr>
  -        <td>View all orgs</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -        <td>View orgs where user is member</td>
  -        <td>Yes<sup><strong>2</strong></sup></td>
  -        <td>Yes<sup><strong>2</strong></sup></td>
  -        <td>Yes<sup><strong>2</strong></sup></td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -    </tr><tr>
  -        <td>Edit, rename, and delete orgs</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes<sup><strong>3</strong></sup></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -        <td>Suspend or activate an org</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr>
  -    <tr>
  -        <td>Create and assign space quota plans</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr>
  -    <tr>
  -        <td>Create spaces</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -        <td>View spaces</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -	    <td>Yes</td>
  -    </tr><tr>
  -        <td>Edit spaces</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>     
  -	<td></td>
  -    </tr><tr>
  -        <td>Delete spaces</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>  
  -        <td></td>
  -	<td></td>
  -    </tr><tr>
  -        <td>Rename spaces</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -        <td>View the status, number of instances, service bindings, and resource use of apps</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -	<td></td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -    </tr><tr>
  -        <td>Add private domains<sup><strong>4</strong></sup></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  +  <tr>
  +    <th>Activity</th>
  +    <th>Admin</th>
  +    <th>Admin Read-Only</th>
  +    <th>Global Auditor</th>
  +    <th>Org Manager</th>
  +    <th>Org Auditor</th>
  +    <th>Org Billing Manager</th>
  +    <th>Org User</th>
  +    <th>Space Manager</th>
  +    <th>Space Developer</th>
  +    <th>Space Auditor</th>
  +  </tr>
  +  <tr>
  +    <td>Scope of operation</td>
  +    <td>Org</td>
  +    <td>Org</td>
  +    <td>Org</td>
  +    <td>Org</td>
  +    <td>Org</td>
  +    <td>Org</td>
  +    <td>Org</td>
  +    <td>Space</td>
  +    <td>Space</td>
  +    <td>Space</td>
  +  </tr>
  +  <tr>
  +    <td>Assign user roles</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>View users and roles</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +  </tr>
  +  <tr>
  +    <td>Create and assign org quota plans</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>View org quota plans</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +  </tr>
  +  <tr>
  +    <td>Create orgs</td>
  +    <td>Yes</td>
  +    <td><sup><strong></strong></sup></td>
  +    <td><sup><strong></strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +    <td><sup><strong>1</strong></sup></td>
  +  </tr>
  +  <tr>
  +    <td>View all orgs</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>View orgs where user is member</td>
  +    <td>Yes<sup><strong>2</strong></sup></td>
  +    <td>Yes<sup><strong>2</strong></sup></td>
  +    <td>Yes<sup><strong>2</strong></sup></td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +  </tr>
  +  <tr>
  +    <td>Edit, rename, and delete orgs</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes<sup><strong>3</strong></sup></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Suspend or activate an org</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Create and assign space quota plans</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Create spaces</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>View spaces</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +	  <td>Yes</td>
  +  </tr>
  +  <tr>
  +    <td>Edit spaces</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +	  <td></td>
  +  </tr>
  +  <tr>
  +    <td>Delete spaces</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +	  <td></td>
  +  </tr>
  +  <tr>
  +    <td>Rename spaces</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>View the status, number of instances, service bindings, and resource use of apps</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +	  <td></td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +  </tr>
  +  <tr>
  +    <td>Add private domains<sup><strong>4</strong></sup></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
       <td>Share private domains with other orgs</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes<sup><strong>5</strong></sup></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -        <td>Deploy, run, and manage apps</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td> 
  -    </tr><tr>   
  -        <td>Use app SSH<sup><strong>6</strong></sup></td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>     
  -    </tr><tr>
  -        <td>Instantiate and bind services to apps</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>        
  -    </tr><tr>
  -        <td>Manage global service brokers</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>        
  -    </tr><tr>
  -        <td>Manage space-scoped service brokers</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>        
  -    </tr><tr>
  -        <td>Associate routes<sup><strong>4</strong></sup>, instance counts, memory allocation, and disk limit of apps</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>        
  -    </tr><tr>
  -        <td>Rename apps</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td>Yes</td>
  -        <td></td>
  -     </tr><tr>
  -        <td>Create and manage Application Security Groups</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -	    <td>Create, update, and delete an Isolation Segment</td>
  -	    <td>Yes</td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -	    <td></td>
  -    </tr><tr>
  -        <td>List all Isolation Segments for an org</td>
  -        <td>Yes</td>
  -        <td>Yes</td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -        <td>Yes<sup><strong>7</strong></sup></td>
  -    </tr><tr>
  -        <td>Entitle or revoke an Isolation Segment</td>
  -        <td>Yes</td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -        <td></td>
  -    </tr><tr>
  -		<td>List all orgs entitled to an Isolation Segment</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -		<td>Yes<sup><strong>7</strong></sup></td>
  -    </tr><tr>
  -		<td>Assign a default Isolation Segment to an org</td>
  -		<td>Yes</td>
  -		<td></td>
  -		<td></td>
  -		<td>Yes</td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -    </tr><tr>
  -		<td>List and manage Isolation Segments for spaces</td>
  -		<td>Yes</td>
  -		<td></td>
  -		<td></td>
  -		<td>Yes</td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -    </tr><tr>
  -		<td>List entitled Isolation Segment for a space</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -    </tr><tr>
  -		<td>List the Isolation Segment on which an app runs</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td></td>
  -		<td></td>
  -		<td></td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -		<td>Yes</td>
  -    </tr><tr>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes<sup><strong>5</strong></sup></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Deploy, run, and manage apps</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Use app SSH<sup><strong>6</strong></sup></td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Instantiate and bind services to apps</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Manage global service brokers</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Manage space-scoped service brokers</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Associate routes<sup><strong>4</strong></sup>, instance counts, memory allocation, and disk limit of apps</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +    <td>Rename apps</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td>Yes</td>
  +    <td></td>
  +   </tr>
  +   <tr>
  +    <td>Create and manage Application Security Groups</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +	  <td>Create, update, and delete an isolation segment</td>
  +	  <td>Yes</td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +	  <td></td>
  +  </tr>
  +  <tr>
  +    <td>List all isolation segments for an org</td>
  +    <td>Yes</td>
  +    <td>Yes</td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +    <td>Yes<sup><strong>7</strong></sup></td>
  +  </tr>
  +  <tr>
  +    <td>Entitle or revoke an isolation segment</td>
  +    <td>Yes</td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +    <td></td>
  +  </tr>
  +  <tr>
  +		<td>List all orgs entitled to an isolation segment</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +		<td>Yes<sup><strong>7</strong></sup></td>
  +  </tr>
  +  <tr>
  +		<td>Assign a default isolation segment to an org</td>
  +		<td>Yes</td>
  +		<td></td>
  +		<td></td>
  +		<td>Yes</td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +  </tr>
  +  <tr>
  +		<td>List and manage isolation segments for spaces</td>
  +		<td>Yes</td>
  +		<td></td>
  +		<td></td>
  +		<td>Yes</td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +  </tr>
  +  <tr>
  +		<td>List entitled isolation segments for a space</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +  </tr>
  +  <tr>
  +		<td>List the isolation segment on which an app runs</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td></td>
  +		<td></td>
  +		<td></td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +		<td>Yes</td>
  +  </tr>
  +  <tr>
   		<td>List app and service usage events</td>
   		<td>Yes</td>
   		<td>Yes</td>
  
positive.code: 		<td></td>
  		<td>Yes</td>
  		<td>Yes</td>
      </tr><tr>
  		<td>Create, delete, and list container to container networking policies</td>
  		<td>Yes</td>
  		<td></td>
  
negative.code: 		<td></td>
  		<td>Yes<sup><strong>8</strong></sup></td>
  		<td></td>
    <tr>
  </table>
  
  <sup><strong>1</strong></sup>Not by default, unless feature flag `user_org_creation` is set to `true`.
  
  <sup><strong>2</strong></sup>Admin, admin read-only, and global auditor roles do not need to be added as members of orgs or spaces to view resources.
  
  <sup><strong>3</strong></sup>Org Managers can rename their orgs and edit some fields. They cannot delete orgs.
  
  <sup><strong>4</strong></sup>Unless disabled by feature flags.
  
  <sup><strong>5</strong></sup>The user attempting to share must have permissions in both the source and target orgs.
  
  <sup><strong>6</strong></sup>This assumes that SSH is enabled for the platform, space, and app. For more information, see [SSH Access Control Hierarchy](../devguide/deploy-apps/app-ssh-overview.html#ssh-access-control-hierarchy) in _App SSH Overview_.
  
  <sup><strong>7</strong></sup>Applies only to orgs they belong to.
  
  <sup><strong>8</strong></sup>Space Developers can optionally be granted these permissions. For more information, see [Grant Permissions](../devguide/deploy-apps/cf-networking.html#-grant-permissions) in _Configuring Container-to-Container Networking_.
  