anchor.diff:  TIP: Given the above permission set, `GET /api/foo` would match both permission sets' paths,
   so would require both the `user` and `admin` roles.
   
  -## Authenticated representation
  +== Authenticated representation
   
   For every authenticated resource, you can inject a `SecurityIdentity` instance to get the authenticated identity information.
   
   In some other contexts you may have other parallel representations of the same information (or parts of it) such as `SecurityContext`
   for JAX-RS or `JsonWebToken` for JWT.
   
  -## Configuration
  +== Configuration
   
   There are two configuration settings that alter the RBAC behavior:
   
  
positive.code:     }
  }
  --
  
negative.code: ...
  ----
  
  == Security Identity Customization
  
  Internally, the identity providers create and update an istance of the `io.quarkus.security.identity.SecurityIdentity` class which holds the principal, roles, credentials which were used to authenticate the client (user) and other security attributes. An easy option to customize `SecurityIdentity` is to register a custom `SecurityIdentityAugmentor`, for example, the augmentor below adds an addition role:
  
  