anchor.diff:      }
   }
   --
  +
  +== Reactive Security
  +
  +If you are going to use security in a reactive environment you will likely need Smallrye Content Propagation:
  +
  +[source,xml]
  +----
  +<dependency>
  +  <groupId>io.quarkus</groupId>
  +  <artifactId>quarkus-smallrye-context-propagation</artifactId>
  +</dependency>
  +----
  +
  +This will allow you to propagate the identity throughout the reactive callback. You also need to make sure you
  +are using an executor that is capable of propagating the identity (e.g. no `CompletableFuture.supplyAsync`),
  +to make sure that quarkus can propagate it. For more information see the
  +link:context-propagation[Context Propagation Guide].
positive.code: and JAX-RS endpoints that do not have security annotations but are defined in classes that contain methods with
  security annotations. Defaults to `false`.
  
  ### Registering Security Providers
  
  When running in native mode the default behavior for Graal native image generation is to only include the main "SUN" provider
  unless you have enabled SSL, in which case all security providers are registered. If you are not using SSL, then you can selectively
  
negative.code: It is also possible to define role based policies, as shown in the example. These policies will only allow users with the
  specified roles to access the resources.
  
  === Matching on paths, methods
  
  Permission sets can also specify paths and methods as a comma separated list. If a path ends with '*' then it is considered
  to be a wildcard match and will match all sub paths, otherwise it is an exact match and will only match that specific path:
  