anchor.diff:  ...  
   -----
   
  -The example above shows that the current user ```anonymous``` has the ```readPublish``` permission on the requested node, only. This means the user is allowed to read a published version of the node but not previous versions or a draft version of the requested element.
  +The example above shows that the requesting user ```anonymous``` has the ```readPublish``` permission on the requested node, only. This means the user is allowed to read the published version of the node but not previous versions or a draft version of the requested element.
   
   Furthermore the user is not allowed to
   
  -* ```create``` other nodes
  +* ```create``` child nodes
   * ```read``` a draft version of the node
   * ```update``` the requested node
   * ```delete``` the requested node
   * ```publish``` a draft version of the requested node, or ```unpublish``` a node.
   
  -IMPORTANT: Gentics Mesh by default returns the ```draft``` version of nodes. This means for supporting the ```anonymous``` user and public content, you need to add the ```?version=published``` query parameter on all requests for nodes to avoid _"Missing permissions on object"_ errors.
  -
  -NOTE: The ```publish``` and ```readPublish``` permissions are specifically available for node elements.
  +IMPORTANT: Gentics Mesh by default returns the ```draft``` version of nodes. This means for supporting the ```anonymous``` user and public content, you need to add the ```?version=published``` query parameter on all requests for nodes to avoid _"Missing permissions on object"_ errors. Find out more in the <<versioning,Versioning>> section.
  +
   
   Following, we will discuss how to query, assign and revoke permissions in Gentics Mesh including the available API endpoints.
   
  -==== API endpoints
  -
  +[caption=]
  +.API endpoints for querying, assigning, and revoking permissions
   [options="header",cols="2*"]
   |======
   
  
positive.code: } 
  -----
  
  Alternatively, the endpoint ```/api/v1/users/:userUuid/permissions/:path``` provides a shortcut for querying permissions for specific users directly, e.g., for user ```anonymous```, which is essentially inheriting all permissions from role ```anonymous```.
  
  .Try the example
  [TIP]
  
negative.code: 
  == Permissions
  
  === Overview
  
  Permissions allow to equip different groups of users with access to content of your project. 
  
  In Gentics Mesh, we distinguish the concepts of 
  link:building-blocks.html#_user[user], link:building-blocks.html#_group[group], and link:building-blocks.html#_role[role] for managing different needs of access.
  
  * A user represents a physical person or a client app that needs to interact with your contents.
  * Groups are used to gather users of same content needs and access levels, e.g. administrators, editors, and users of your app. 
  * A role describes a set of permissions on other elements in Gentics Mesh, e.g. nodes, tags, schemas, users.
  
  By assigning a role to a group, the role's permissions are efficiently granted to a set of users.
  
  NOTE: For reasons of readability, we will describe granting permissions to users though technically, permissions are granted to a specific role and applied to users via groups. 
  
  // TODO image (anonymous, and other roles having different permissions)
  
  
  
  [caption=]
  .Permissions in Gentics Mesh
  [options="header"]
  |======
  | Permission    | Description
  | create        | grants the right to create instances of the element
  | read          | grants read access to the element
  | update        | grants the right to update the element
  | delete        | grants the right to delete the element
  | publish       | grants the right to publish/unpublish a node
  | readPublished | grants the right to read the published version of the node
  |======
  
  NOTE: The ```publish``` and ```readPublish``` permissions are specifically available for node elements.
  
  Most API responses within Gentics Mesh contain a list of permissions. This list indicates which permissions have been granted on the returned element(s) to the requesting user.
  
  ==== Example
  
  .Try the example
  [TIP]
  https://demo.getmesh.io/api/v1/demo/nodes/fc3c85be82584ae2bc85be82588ae2b0?version=published
  // TODO provide new example node, remove read permission for this example node only, add ?version=published to example code
  
  
  [source,json]
  -----
  // permissions for node https://demo.getmesh.io/api/v1/demo/nodes/fd58237c79d64bf198237c79d6bbf107?version=published
  ...
    "permissions" : {
      "create" : false,        //create other nodes
  