anchor.diff:  == Global Roles and Bindings
   There are two levels of roles and bindings: global and local (project scoped). This two level hierarchy allows re-usability over multiple projects while allowing controlled customization inside of individual projects. Local bindings can reference both global and local roles. Global bindings can only reference global roles.
   
  -During evaluation both the global bindings and the local bindings are used, in that order. The search order also ensures that a global allow overrides a local deny. For example:
  +During evaluation both the global bindings and the local bindings are used, in that order. The search order also ensures that a global deny allow overrides a local deny. For example:
   
   . Globally bound deny rules are checked.
   . Globally bound allow rules are checked.
  
positive.code: 
  Authorization determines whether an identity is allowed to perform any action. Note that authorization is a separate step from authentication, which is more about determining who (identity) is taking the action.
  
  Authorization is managed using rules, roles, and bindings. A rule describes the permission that each user has in relation to performing an action, and a role is a collection of rules. Users and groups may be bound to multiple roles at the same time. Lastly, a binding associates a role with a list of users and groups, and decides which rules apply to which user. 
  
  Several factors are combined to make the decision when authorization is evaluated:
  
  
negative.code: OpenShift includes four global roles out of the box:
  
  * *Cluster-admin*: A super-user that can perform any action in any project.
  * *Admin*: A project manager. If used in a local binding, an admin user will have rights to view any resource in the project and modify any resource in the project except for role creation and quota.  If the cluster-admin wants to allow an admin to modify roles, the cluster-admin must create a project scoped Policy object.
  * *Edit*: A user that can modify most objects in a project, but does not have the power to view or modify roles or bindings.
  * *View*: A user who cannot make any modifications, but can see most objects in a project. They cannot view or modify roles or bindings.
  
  