anchor.diff:  
   [source,ini]
   ----
  -user_role = *:ToDoItems:*:*,\
  -            *:ToDoItem:*:*,\
  -            *:TodoAppDashboard:*:*
  -analysis_role = *:ToDoItemAnalysis:*:*,\
  -            *:ToDoItemsByCategoryViewModel:*:*,\
  -            *:ToDoItemsByDateRangeViewModel:*:*
  -self-install_role = *:ToDoItemsFixturesService:install:*
  +user_role = myapp.*,\
  +            isis.security:*,\
  +            isis.applib:*
   admin_role = *
   ----
   
  
positive.code: 
  [source,ini]
  ----
  packageName:className:memberName:r,w
  ----
  
  where:
  
  * `memberName` is the property, collection or action name.
  * `r` indicates that the member is visible
  * `w` indicates that the member is usable (editable or invokable)
  
  and where each of the parts of the permission string can be wildcarded using `*`.
  
  Because these are wildcards, a '*' can be used at any level.
  Additionally, missing levels assume wildcards.
  
  Thus:
  
  [source,ini]
  ----
  com.mycompany.myapp:Customer:firstName:r,w   # view or edit customer's firstName
  com.mycompany.myapp:Customer:lastName:r      # view customer's lastName only
  com.mycompany.myapp:Customer:placeOrder:*    # view and invoke placeOrder action
  com.mycompany.myapp:Customer:placeOrder      # ditto
  com.mycompany.myapp:Customer:*:r             # view all customer class members
  com.mycompany.myapp:*:*:r                    # view-only access for all classes in myapp package
  com.mycompany.myapp:*:*:*                    # view/edit for all classes in myapp package
  com.mycompany.myapp:*:*                      # ditto
  com.mycompany.myapp:*                        # ditto
  com.mycompany.myapp                          # ditto
  *                                            # view/edit access to everything
  ----
  
  [TIP]
  ====
  The format of the permissions string is configurable in Shiro, and Apache Isis uses this to provide an extended wildcard format, described xref:security:shiro:about.adoc#enhanced-wildcard-permission[here].
  ====
  
  === Externalized IniRealm
  
  
negative.code: 
  [source,ini]
  ----
  user_role   = !reg/myapp.api,\
                !reg/myapp.webapp.services.admin,\
                reg/* ; \
  api_role    = myapp.api ;\
  admin_role = adm/*
  ----
  
  sets up:
  
  * the `user_role` with access to all permissions except those with a logical type's namespace of `myapp.api` or `myapp.webapp.services.admin`
  * the `api_role` with access to all permissions to logical types under the namespace `myapp.api`
  * the `admin_role` with access to everything.
  
  The permission group concept is required to scope the applicability of any veto permission.
  