anchor.diff:  
   You use different commands to apply an ASG to each of the four sets. For more information, see the [Procedures](#procedures) section of this topic.
   
  -<p class="note"><strong>Note</strong>: To apply a staging ASG to apps within a space, you must use cf CLI 6.28.0 or later.</p>
  +<p class="note"><strong>Note</strong>: To apply a staging ASG to apps within a space, you must use cf CLI 6.28.0 or later.
  +</p>
   
   ### <a id='creating-groups'></a>The Structure and Attributes of ASGs ##
   
  
positive.code: </pre>
  
  <p class='note'><strong>Note</strong>: Updating an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space,
  use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  ### <a id='unbinding-groups'></a>Unbind ASGs
  
  <p class='note'><strong>Note</strong>: Unbinding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space,
  use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To unbind an ASG from the platform-wide staging ASG set, run `cf unbind-staging-security-group SECURITY-GROUP`. Replace `SECURITY-GROUP` with the name of your security group.
  
  
negative.code: Example app dependencies include public Maven repositories, NPM, RubyGems, and 
  Docker registries.
  
  <p class='note'><strong>Note</strong>: You should exclude IaaS metadata endpoints, such as <code>169.254.169.254</code>, because the metadata endpoint can expose sensitive environment information to untrusted apps. The <code>public_networks</code> example below accounts for this recommendation.
  </p>
  
  Example `public_networks` ASG:
  
  