anchor.diff:       max: 6000
   ...
   ----
  -<1> The `allow*` bools are the same as for the *restricted* SCC.
  +<1> The `allow` booleans are the same as for the *restricted* SCC.
   <2> Name of the new SCC.
   <3> Numerically larger numbers have greater priority. Nil or omitted is the lowest
   priority. Higher priority SCCs sort before lower priority SCCs and thus have a
   better chance of matching a new pod.
  -<4> `*supplementalGroups*` is a strategy and it is set to *MustRunAs*, which means
  +<4> `supplementalGroups` is a strategy and it is set to *MustRunAs*, which means
   group ID checking is required.
   <5> Multiple ranges are supported. The allowed group ID range here is 5000 through
   5999, with the default supplemental group being 5000.
  
positive.code: [[sccs-defaults-allowed-ranges]]
  == SCCs, Defaults, and Allowed Ranges
  
  SCCs influence whether or not a pod is given a default user ID, `*fsGroup*` ID,
  supplemental group ID, and SELinux label. They also influence whether or not IDs
  supplied in the pod definition (or in the image) will be validated against a
  range of allowable IDs. If validation is required and fails, then the pod will
  also fail.
  
  SCCs define strategies, such as `*runAsUser*`, `*supplementalGroups*`, and
  `*fsGroup*`. These strategies help decide whether the pod is authorized.
  Strategy values set to *RunAsAny* are essentially stating that the pod can do
  what it wants regarding that strategy. Authorization is skipped for that
  strategy and no {product-title} default is produced based on that strategy.
  
negative.code: <1> *MustRunAs* causes volume relabeling.
  <2> If the label is not provided in the pod or in the SCC, then the default comes
  from the project.
  
  All predefined SCCs, except for the *privileged* SCC, set the `seLinuxContext`
  to *MustRunAs*. This forces pods to use MCS labels, which can be defined in the
  pod definition, the image, or provided as a default.
  
  The SCC determines whether or not to require an SELinux label and can provide a
  default label. If the `seLinuxContext` strategy is set to *MustRunAs* and the
  pod (or image) does not define a label, {product-title} defaults to a label
  chosen from the SCC itself or from the project.
  
  If `seLinuxContext` is set to *RunAsAny*, then no
  default labels are provided, and the container determines the final label. In
  the case of Docker, the container will use a unique MCS label, which will not
  likely match the labeling on existing storage mounts. Volumes which support
  