anchor.diff:  ==== Multiple Roles with Document and Field Level Security
   
   A user can have many roles and each role can define different permissions on the
  -same index. It is important to understand the behavior of Document and Field Level
  -security in this scenario.
  -
  -Document level security will take into account each role held by the user, and
  -combine each document level security query for a given index with an "OR". This
  +same index. It is important to understand the behavior of document and field
  +level security in this scenario.
  +
  +Document level security takes into account each role held by the user and
  +combines each document level security query for a given index with an "OR". This
   means that only one of the role queries must match for a document to be returned.
   For example, if a role grants access to an index without document level security
   and another grants access with document level security, document level security
  -will not be applied; the user with both roles will have access to all of the
  -documents in the index.
  -
  -Field level security will take into account each role the user has and combine
  +is not applied; the user with both roles has access to all of the documents in
  +the index.
  +
  +Field level security takes into account each role the user has and combines
   all of the fields listed into a single set for each index. For example, if a
   role grants access to an index without field level security and another grants
  -access with field level security, field level security will not be applied for
  -that index; the user with both roles will have access to all of the fields in
  -in the index.
  +access with field level security, field level security is not be applied for
  +that index; the user with both roles has access to all of the fields in the
  +index.
  +
  +For example, let's say `role_a` grants access to only the `address` field of the
  +documents in `index1`; it doesn't specify any document restrictions. Conversely,
  +`role_b` limits access to a subset of the documents in `index1`; it doesn't
  +specify any field restrictions. If you assign a user both roles, `role_a` gives
  +the user access to all documents and `role_b` gives the user access to all
  +fields.
  +
  +If you need to restrict access to both documents and fields, consider splitting
  +documents by index instead.
  
positive.code:       the respective indices permission entry.
  
  The specified `query` expects the same format as if it was defined in the
  search request and supports ELasticsearch's full {ref}/query-dsl.html[Query DSL].
  
  For example, the following role grants read access to all indices, but restricts
  access to documents whose `department_id` equals `12`.
  
  [source,js]
  --------------------------------------------------
  
negative.code: }
  --------------------------------------------------
  
  The following role definition enables only read access to the customer `handle`
  field:
  
  [source,js]
  --------------------------------------------------
  