anchor.diff:  ==== Document Level Security
   
   Document level security restricts the documents that users have read access to.
  -To enable document level security, you specify a query that matches all the
  +To enable document level security, specify a query that matches all the
   accessible documents as part of the indices permissions within a role definition.
  -This binds document level security to a well defined set of indices.
  -
  -Enabling document level security restricts which documents can be accessed from any document based read API.
  -To enable document level security, you use a query to specify the documents that each role can access in the `roles.yml` file.
  -You specify the document query with the `query` option. The document query is associated with a particular index or index pattern and
  -operates in conjunction with the privileges specified for the indices.
  +Document level security is thus bound to a well defined set of indices.
  +
  +Enabling document level security restricts which documents can be accessed from
  +any document-based read API. To enable document level security, you use a query
  +to specify the documents that each role can access in the `roles.yml` file.
  +You specify the document query with the `query` option. The document query is
  +associated with a particular index or index pattern and operates in conjunction
  +with the privileges specified for the indices.
   
   The following role definition grants read access only to documents that
  -belong to the `click` category within all the `events-*` indices.
  +belong to the `click` category within all the `events-*` indices:
   
   [source,js]
   --------------------------------------------------
  
positive.code: | `properties`  | no        | [`username`, `roles`, `email`, `full_name`, `metadata`]   | Controls what user related properties are added to the `field`.
  |======
  
  Example config that adds all user details of the current authenticated user to the `user` field to  all documents being
  processed by this pipeline:
  
  [source,js]
  --------------------------------------------------
  
negative.code: }
  --------------------------------------------------
  
  The following role definition enables only read access to the customer `handle`
  field:
  
  [source,js]
  --------------------------------------------------
  