anchor.diff:  {security} also provides a set of built-in roles you can explicitly assign
   to users. These roles have a fixed set of privileges and cannot be updated.
   
  -[[built-in-roles-ingest-user]]
  -`ingest_admin` ::
  +[[built-in-roles-ingest-user]] `ingest_admin` ::
   Grants access to manage *all* index templates and *all* ingest pipeline configurations.
   +
   NOTE: This role does *not* provide the ability to create indices; those privileges
   must be defined in a separate role.
   
  -[[built-in-roles-kibana-system]]
  -`kibana_system` ::
  +[[built-in-roles-kibana-system]] `kibana_system` ::
   Grants access necessary for the <<kibana, Kibana system user>>
   to read from and write to the Kibana indices and check the availability of the
   Elasticsearch cluster.
  
positive.code: index templates, mappings, node and basically everything about the cluster.
  However, this role does not grant permission to view the data in all indices.
  
  [[built-in-roles-watcher-admin]]
  `watcher_admin`::
  +
  Grants write access to the `.watches` index, read access to the watch history and
  the triggered watches index and allows to execute all watcher actions.
  
  [[built-in-roles-watcher-user]]
  `watcher_user`::
  +
  Grants read access to the `.watches` index, the get watch action and the watcher
  stats.
  
negative.code: NOTE: This role should not be assigned to users as the granted permissions may
  change between releases.
  
  [[built-in-roles-kibana-user]] `kibana_user`::
  Grants the minimum privileges required for any user of Kibana. This role grants
  access to the Kibana indices and grants  monitoring privileges for the cluster.
  
  [[built-in-roles-logstash-system]] `logstash_system` ::
  Grants access necessary for the <<ls-monitoring-user, Logstash system user>>
  to send system-level data (such as monitoring) to Elasticsearch.
  +
  