anchor.diff:  Logged when the <<security-api-delete-role,delete role API>> is invoked to
   delete a role.
   +
  +You must include the `security_config_change` event type to audit the related
  +event action.
  ++
   .Example
   [%collapsible%open]
   ====
  
positive.code: `put_role`::
  Logged when the <<security-api-put-role,create or update role API>> is invoked to create or
  update a role.
  +
  .Example
  [%collapsible%open]
  
negative.code:                         of transport messages, generating audit events with
                          `origin.type: rest` and `event.type: transport`.
  `event.action`    ::    The type of event that occurred: `anonymous_access_denied`,
  `authentication_failed`, `authentication_success`,
  `realm_authentication_failed`, `access_denied`, `access_granted`,
  `connection_denied`, `connection_granted`, `tampered_request`,
  `run_as_denied`, or `run_as_granted`.
  +
  In addition, if `event.type` equals <<security-config-change,`security_config_change`>>,
  the `event.action` attribute takes one of the following values:
  `put_user`, `change_password`, `put_role`, `put_role_mapping`,
  `change_enable_user`, `change_disable_user`, `put_privileges`, `create_apikey`, 
  `delete_user`, `delete_role`, `delete_role_mapping`, `invalidate_apikeys` or 
  `delete_privileges`.
  
  `request.id`      ::    A synthetic identifier that can be used to correlate the events
                          associated with a particular REST request.
  
  